Meltdown Code Proves Concept

January 11, 2018 by Al Williams 46 Comments

If you’ve read about Meltdown, you might have thought, “how likely is that to actually happen?” You can more easily judge for yourself by looking at the code available on GitHub. The Linux software is just proof of concept, but it both shows what could happen and — in a way — illustrates some of the difficulties in making this work. There are also two videos in the repository that show spying on password input and dumping physical memory.

The interesting thing is that there are a lot of things that will stop the demos from working. For example a slow CPU, a CPU without out-of-order execution, or an imprecise high-resolution timer. This is apparently especially problematic in virtual machines.

Continue reading “Meltdown Code Proves Concept” →

Turn Command Lines Into Web Apps

November 19, 2017 by Al Williams 15 Comments

Even if you like using a graphical user interface, you can probably agree that writing a graphical program is usually harder than writing an old-fashioned text-based program. Putting that GUI into an online format means even more to think about. [Adam Kewley] has the answer to that problem: Jobson. As you can see in the video below, the program is a web server that runs command line programs as jobs.

Simply write a YAML file to describe the program’s inputs and outputs and Jobson will create input fields for arguments and display the output in a web page. Any files the program creates are available to download. Basically any command line program can be quickly and easily pulled into one web interface to rule them.

If a program takes a long time to run, Jobson will let you switch away and then later resume looking at the output. You can also abort a job or look at the arguments it received. Jobson can also authenticate users with several different methods to prevent just anyone from executing jobs.

If you really want to write a graphical program, try QTCreator. Or, you can get a shell in a web browser if you want to go that route. But this is the smoothest method we’ve seen for gathering command line programs into one place for monitoring and control. Neat!

Continue reading “Turn Command Lines Into Web Apps” →

Ad Hoc MIDI To Music Box Project Shows Power Of Hacker Community

May 6, 2017 by Dan Maloney 9 Comments

Fair warning: when you post a video of you doing an incredibly tedious process like manually punching holes in a paper tape to transfer a MIDI file to a music box, don’t be surprised when a bunch of hackers automates the process in less than a week.

The back story on this should be familiar to even casual Hackaday readers. [Martin] from the Swedish group “Wintergatan” is a prolific maker of unusual musical instruments. You’ll no doubt recall his magnificent marble music machine, a second version of which is currently in the works. But he’s also got a thing for music boxes that are programmed by paper tape, and recently posted a video showing his time-consuming and totally manual process for punching the holes in the tape. Since his source material was already in a MIDI file, a bunch of his fans independently came up with ways to automate the process.

The video below shows what he learned from his fans about automating his programming, but also what he learned about the community we all work and play in. Without specifically asking for help, random strangers brought together by common interests identified the problems, came up with solutions, sorted through the good and the bad ideas, and made the work publically available. Not bad for less than a week’s work.

Continue reading “Ad Hoc MIDI To Music Box Project Shows Power Of Hacker Community” →

File Format Posters

April 7, 2017 by Zoe Skyforest 28 Comments

It’s not uncommon for hackers to have a particular delectation for unusual interior decoration. Maybe it’s a Nixie tube clock, or a vacuum fluorescent display reading out the latest tweets from a favorite chatbot. If this sounds like your living room already, perhaps you’d like some of these file format posters to adorn your walls.

The collection of images includes all kinds of formats — GIF, ZIP and WAV are all represented, but it even gets into some real esoterica — DOLphin format executables are here if you’re a total GameCube fanatic. Each poster breaks down the format into parts, such as the header, metadata and descriptor sections, and come in a variety of formats themselves — most available in SVG, PDF and PNG.

If we’re totally honest, these aren’t all designed for hanging on your wall as-is — we’d consider putting some work into to optimize the color palettes and layouts before putting these to print. But regardless, they’re an excellent visual representation of data structures that you might find particularly useful if you need to do some reverse engineering down the track.

If you still have wall space available after seeing this, here’s the electronic reference poster that should fill it.

[Thanks to JD for the tip!]

TruffleHog Sniffs Github For Secret Keys

January 13, 2017 by Zoe Skyforest 22 Comments

Secret keys are quite literally the key to security in software development. If a malicious actor gains access to the keys securing your data, you’re toast. The problem is, to use keys, you’ve got to write them down somewhere – oftentimes in the source code itself. TruffleHog has come along to sniff out those secret keys in your Github repository.

It’s an ingenious trick — a Python script goes through the commit history of a repository, looking at every string of text greater than 20 characters, and analyzing its Shannon entropy. This is a mathematical way of determining if it looks like a relatively random string of numbers and letters. If it has high entropy, it’s probably a key of some sort.

Sharing source code is always a double-edged sword for security. Any flaws are out for all to see, and there are both those who will exploit the flaws and those who will help fix them. It’s a matter of opinion if the benefits outweigh the gains, but it’s hard to argue with the labor benefits of getting more eyes on the code to hunt for bugs. It’s our guess though, that a lot of readers have accidentally committed secret keys in a git repository and had to revert before pushing. This tool can crawl any publicly posted git repo, but might be just as useful in security audits of your own codebase to ensure accidentally viewable keys are invalidated and replaced.

For a real world example of stolen secret keys, read up on this HDMI breakout that sniffs HDCP keys.

Interactive ESP8266 Development With PunyForth

December 23, 2016 by Al Williams 17 Comments

Forth is one of those interesting languages that has a cult-like following. If you’ve never looked into it, its strength is that it is dead simple to put on most CPUs, yet it is very powerful and productive. There are two main principles that make this possible. First, parsing is easy because any sequence of non-space characters makes up a legitimate Forth word. So while words like “double” and “solve” are legal Forth words, so is “#$#” if that’s what you want to define.

The other thing that makes Forth both simple and powerful is that it is stack-based. If you are used to a slide rule or an HP calculator, it is very natural to think of “5+2*3” as “5 2 3 * +” but it is also very simple for the computer to interpret.

[Zeroflag] created PunyForth–a Forth-like language for the ESP8266. You can also run PunyForth for cross development purposes on Linux (including the Raspberry Pi). The system isn’t quite proper Forth, but it is close enough that if you know Forth, you’ll have no trouble.

Continue reading “Interactive ESP8266 Development With PunyForth” →