A PoC was just published for a potentially serious flaw in the Ghostscript interpreter. Ghostscript can load Postscript, PDF, and SVG, and it has a feature from Postscript that has been a continual security issue: the
%pipe% command. This command requests the interpreter to spawn a new process — It’s RCE as part of the spec. This is obviously a problem for untrusted images and documents, and Ghostscript has fixed security vulnerabilities around this mis-feature several times over the years.
This particular vulnerability was discovered by [Emil Lerner], and described at ZeroNights X. That talk is available, but in Russian. The issue seems to be a bypass of sorts, where the pipe command appears to be working in the
/tmp/ directory, but a simple semicolon allows for an arbitrary command to be executed. Now why is this a big deal? Because ImageMagick uses Ghostscript to open SVG images by default on some distributions, and ImageMagick is often used for automatically resizing and converting images for web sites. In [Emil]’s presentation, he uses this flaw as part of an attack chain against three different companies.
I was unable to reproduce the flaw on my Fedora install, but I haven’t found any notice of it being fixed in the Ghostscript or Imagemagick changelogs either. It’s unclear if this problem has already been fixed, or if this is a true 0-day for some platforms. Either way, expect attackers to start trying to make use of it.
Continue reading “This Week In Security: Ghoscript In Imagemagick, Solarwinds, And DHCP Shenanigans”
With a gorgeous view of the Italian seaside, we’re not surprised [Danilo Larizza] had a couple IP cameras set up to pull in real-time views. But using a Raspberry Pi, an environmental sensor, and some software trickery to overlay the current (and naturally, perfect) weather conditions over the images? Now he’s just teasing us.
Whatever his motives are, we have to admit that the end result is very nice. Especially when you find out that there’s no complex hardware or software at work here. An original Raspberry Pi is doing all the heavy lifting by pulling a frame from the external IP camera using
ffmpeg, polling the I2C-connected BME280 temperature and humidity sensor with a Python script, and then producing a final snapshot with the environmental data laid over top using ImageMagick.
[Danilo] gives the exact commands he’s using for each step of the process, making it easy to follow along and see how everything comes together in the end. That also makes it much easier to adapt for your own purposes should you feel so inclined. Once you see how all the pieces fit together, where the data and images come from is up to you.
We’ve previously shown how some simple Python code can be used to turn your raw data into attractive images, and combining that with real-world photographs is an excellent way of turning a text file full of values into a display worth showing off.
What an interesting way to show a year: Norwegian hacker [Erikso] created a condensed timelapse that shows a year in a single photo. He had taken a timelapse of the view from his living room window in the frozen north every day during 2010, using a camera that was locked in place taking an image every 30 minutes. Then, with the help of some hacker friends, he came up with a script that slices these images up and combines them so that each day is represented by a vertical slice. The result is a gorgeous image that gives a wonderful sense of the seasons, and how that affects the trees. You can see the leaves grow and fall, and the snow on the ground come, go and come again.
Continue reading “Four Seasons In One Photo”
Here’s an automated setup that lets you create flat images of cylindrical objects. The example shown above takes a creamer and lets you see what the painted pattern looks like when viewed continuously.
The image capture rig is similar to turntable photography setups that allow you to construct animated GIF files or 3D models of objects. The subject is places on a stepper motor which allows precise control when rotating the object between frames. The EiBotBoard (which we’ve seen in at least one other project) is designed for the EggBot printer. But it is used here to interface the motor and capture equipment with the Raspberry Pi.
We’re a little uncertain if the RPi actually handles the image manipulation. The project uses ImageMagick, which will certainly run on the RPi. There is a mention of the Raspberry Pi camera joing the rig as a future improvement so we do expect to see a fully-automatic revision at some point.
[via Adafruit via EMSL]
This is a Raspberry Pi outfitted in a DSLR battery grip. [Dave H] was very interested in the idea of combining a single-board computer with a high-end camera. The size and cost of such a computer was prohibitive until the RPi came along. He managed to fit the board into the broken battery grip he had on hand, and he already has the prototype up and running.
[Dave’s] alterations to the battery grip allow access to the USB, Ethernet, and Composite video ports. Powering the RPi was a bit of a challenge. He tried using an iPhone charger with four AA batteries but that only provided 4.2V. After going back to the drawing board he discovered he could rework the parts that he removed from the grip, using a Cannon 7.2V 1800 mAh battery. So far he can automatically pull images from the Camera and transmit them over a network connection. But since the RPi is running Linux, there’s a whole world of hacks just waiting to be exploited. What comes to mind first is image manipulation software (like ImageMagick) which has a command-line interface.
[Daniel Paluska] is getting away from the point-and-click by editing videos from the command line. Using the free open source software packages FFmpeg, Imagemagick, and Sox he produces new clips from multiple videos with effects like overlaying, slicing, and assigning each video to a different quadrant. The last option would be useful for displaying different angled shots of the same thing all at once but we’re sure you can find a way to use them all. He is using shell scripts to automate some of the process but the commands are still easy enough to understand if this is your first foray into these tools. After all, great video production will go a long way toward becoming an Internet sensation.