< Back to JetLib.com

jetlib.sec

Feeds

266762 items (22 unread) in 27 feeds

« Expand/Collapse

Unread items (22)

May 25, 2021
8:06
FBI Analyst Indicted For Theft Of Osama bin Laden Threat Intel
» ‎ Packet Storm Security Headlines

FBI Analyst Indicted For Theft Of Osama bin Laden Threat Intel
Tags:
May 20, 2021
8:39
4 Vulnerabilities Under Attack Give Hackers Full Control Of Android Devices
» ‎ Packet Storm Security Headlines

4 Vulnerabilities Under Attack Give Hackers Full Control Of Android Devices
Tags:
May 13, 2021
7:25
Tesla Stops Accepting Bitcoin Due To Fossil Fuel Use
» ‎ Packet Storm Security Headlines

Tesla Stops Accepting Bitcoin Due To Fossil Fuel Use
Tags:
April 23, 2021
7:40
Malware Operators Use TLS 46% Of The Time When Detected
» ‎ Packet Storm Security Headlines

Malware Operators Use TLS 46% Of The Time When Detected
Tags:
7:40
Taiwan Authorities Look Into Apple Supplier Hack
» ‎ Packet Storm Security Headlines

Taiwan Authorities Look Into Apple Supplier Hack
Tags:
7:40
Ransomware Is Growing At An Alarming Rate, Warns GCHQ Chief
» ‎ Packet Storm Security Headlines

Ransomware Is Growing At An Alarming Rate, Warns GCHQ Chief
Tags:
7:40
MI5 Tries To Change Image By Opening Up Instagram Account
» ‎ Packet Storm Security Headlines

MI5 Tries To Change Image By Opening Up Instagram Account
Tags:
April 22, 2021
8:19
Signal CEO Hacks Cellebrite iPhone Hacking Device Used By Cops
» ‎ Packet Storm Security Headlines

Signal CEO Hacks Cellebrite iPhone Hacking Device Used By Cops
Tags:
8:19
Bugs Allowed Hackers To Dox All John Deere Owners
» ‎ Packet Storm Security Headlines

Bugs Allowed Hackers To Dox All John Deere Owners
Tags:
8:19
Telegram Platform Abused In ToxicEye Malware Campaigns
» ‎ Packet Storm Security Headlines

Telegram Platform Abused In ToxicEye Malware Campaigns
Tags:
8:19
SolarWinds Hack Analysis 56% Boost In Command Server Footprint
» ‎ Packet Storm Security Headlines

SolarWinds Hack Analysis 56% Boost In Command Server Footprint
Tags:
April 21, 2021
7:27
Zero-Day Vulns In SonicWall Email Security Are Being Exploited
» ‎ Packet Storm Security Headlines

Zero-Day Vulns In SonicWall Email Security Are Being Exploited
Tags:
7:27
Mozilla Fixes Firefox Flaw That Allowed Spoofing Of HTTPS Browser Padlock
» ‎ Packet Storm Security Headlines

Mozilla Fixes Firefox Flaw That Allowed Spoofing Of HTTPS Browser Padlock
Tags:
7:27
Campaign Targets Bloomberg Clients With RATs
» ‎ Packet Storm Security Headlines

Campaign Targets Bloomberg Clients With RATs
Tags:
7:27
Lessons Learned From SolarWinds And Exchange Hacks
» ‎ Packet Storm Security Headlines

Lessons Learned From SolarWinds And Exchange Hacks
Tags:
April 20, 2021
9:00
MI5 Warns Of Spies Using LinkedIn To Trick Staff Into Spilling Secrets
» ‎ Packet Storm Security Headlines

MI5 Warns Of Spies Using LinkedIn To Trick Staff Into Spilling Secrets
Tags:
9:00
Facebook Downplays Data Breach In Internal Email
» ‎ Packet Storm Security Headlines

Facebook Downplays Data Breach In Internal Email
Tags:
9:00
Lazarus Hacking Group Now Hides Payloads In BMP Image Files
» ‎ Packet Storm Security Headlines

Lazarus Hacking Group Now Hides Payloads In BMP Image Files
Tags:

April 13, 2021
11:45
Bugtraq: BugTraq Shutdown
» ‎ SecurityFocus Vulnerabilities

Bugtraq: BugTraq Shutdown
Tags:
11:30
Bugtraq: Re: [SECURITY] [DSA 4628-1] php7.0 security update
» ‎ SecurityFocus Vulnerabilities

Bugtraq: Re: [SECURITY] [DSA 4628-1] php7.0 security update
Tags:
11:15
Bugtraq: Re: BugTraq Shutdown
» ‎ SecurityFocus Vulnerabilities

Bugtraq: Re: BugTraq Shutdown
Tags:
10:57
Bugtraq: On Second Thought...
» ‎ SecurityFocus Vulnerabilities

Bugtraq: On Second Thought...
Tags:

Recent items

Skip to page: 1 2 3 ... 928

December 21, 2019
0:00
Vuln: Yokogawa Vnet/IP Open Communication Driver CVE-2018-16196 Denial of Service Vulnerability
» ‎ SecurityFocus Vulnerabilities

Yokogawa Vnet/IP Open Communication Driver CVE-2018-16196 Denial of Service Vulnerability
Tags:

October 16, 2019
13:19
CVE-2019-5533 - VMware VeloCloud Authorization Bypass
» ‎ Bugtraq

Posted by Advisories on Oct 16
#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product: VeloCloud
# Vendor: VMware
# CVE ID: CVE-2019-5533
# CSNC ID: CSNC-2019-007
# Subject: Authorization Bypass
# Risk:...

Tags:

13:00
Painting with Light: The Homemade Pixelstick
» ‎ Hack a Day

Light painting has long graced the portfolios of long-exposure photographers, but high resolution isn’t usually possible when you’re light painting with human subjects.

This weekend project from [Timmo] uses an ESP8266-based microcontroller and an addressable WS2812-based LED strip to paint words or custom images in thin air. It’s actually based on the Pixelstick, a tool used by professional photographers for setting up animations and photorealism shots. The equipment needed for setting up the light painting sticks runs in the order of hundreds, not to mention the professional camera and lenses needed. Nevertheless, it’s a huge step up from waving around a flashlight with your friends.

The LED Lightpainter takes the Pixelstick a few notches lower for amateur photographers and hobbyists. It directly supports 24-bit BMP, with no conversion needed. Images are stored internally in Flash memory and are uploaded through a web interface. The settings for the number of LEDs, time for the image row, and STA/AP-mode for wireless connections are also set by the web interface. The project uses the Adafruit NeoPixel, ArduinoJson, and Bodmer’s TFT_HX8357 libraries for implementing the BMP drawing code, which also allows for an image preview prior to uploading the code to the microcontroller. Images are drawn from the bottom row to the top, so images have to be transformed before updating to the LED painter.

Some future improvements planned for the project include TFT/OLED support, rainbow or color gradient patterns in the LEDs, and accelerometer or gyroscope support for supporting animation.

There aren’t currently too many galleries of DIY LED-enabled light paintings, but we’d love to see some custom modded light painting approaches in the future.

This isn’t the first LED light stick we’ve seen, if you’re interested in such things.

Tags: arduino hacks
11:30
The Smallest Homebrewed TTL CPU In the World
» ‎ Hack a Day

The may very well be the smallest homemade TTL CPU we’ve ever seen. Measuring at one square inch, this tiny chip boasts 40 connections, an 8-bit databus, a 16-bit address bus, a 64 kB memory space, reset and clock inputs, and 5 V power lines.

TTL (transistor transistor logic) logic chips are pretty outdated today, but they do have all of the basics necessary for building a computer – logic gates, counters, buffers, and registers. The transistors perform both the logic and amplifying, as compared to resistor-transistor logic (RTL) and diode-transistor logic (DTL). In the 60s, when the technology was still fairly new, TTL ICs were commonly used in computers and industrial controls. Even after the advent of VLSI, TTL ICs were still being used for interfacing more densely integrated chips. Even so, most TTL chips tend to be on the bulkier side, which is what makes [roelh]’s project so unique. The entire PCB is hardly any larger than a coin.

On top of the hardware specs, [roelh] also implemented several useful software features: zero page addressing, load/store/compare instructions, stacks, conditioning branching, subroutine calls, and memory-mapped I/O. The registers are also in RAM, which has been implemented in microprocessors in the past (see TMS9900) for speed considerations, but in this case was implemented for size constraints.

An ALU was also left out of the design in order to constrain its size, leaving only 8 ICs on either side of the 2-layer PCB.

Microprograms are stored in Flash memory and can be programmed with a Raspberry Pi. by saving the Assembly code to a memory card and downloading the assembled binary code. Once the Raspberry Pi is connected to the development board, you can burn the binary code onto the Flash memory of the board using a Python script. An online Javascript editor also exists for assembling the Assembly code for the chip and simulating the CPU.

There is currently a development board made for the CPU, which includes six seven-segment displays and an I/O connector for running a digital clock and other applications. [roelh] has since built a retro TTL computer around the chip, which reintroduces the ALU and includes address registers, 256 KB of RAM, VGA video, PS/2 keyboard port, a sound system, and I/O pins. It’s a really exciting project that’s seriously pushing the constraints of retro computing.
The HackadayPrize2019 is Sponsored by:

Tags: Hardware
10:01
RTFM: ADCs and DACs
» ‎ Hack a Day

It’s tough to find a project these days that doesn’t use an analog-to-digital converter (ADC) or digital-to-analog converter (DAC) for something. Whether these converters come as built-in peripherals on a microcontroller, or as separate devices connected over SPI, I2C, or parallel buses, all these converters share some common attributes, and knowing how to read the specs on them can save you a lot of headaches when it comes to getting things working properly.

There are some key things to know about these devices, and the first time you try to navigate a datasheet on one, you may find yourself a bit confused. Let’s take a deep dive into the static (DC) properties of these converters — the AC performance is complex enough to warrant its own follow-up article.

The Two Domains
Think of digital pins on a microcontroller. The value of the pin can be a 1 or a 0 and it’s easy to understand that the voltage for those values will be zero volts or five volts (assuming our microcontroller is powered by a five volt source). What about all those voltages in between? If we need to measure or generate a signal anywhere in between the zero and five volt levels we’re going to need an ADC or DAC. But there are myriad different uses for the two.

The obvious purpose of these converters is to translate a quantity between analog and digital domains. Shown in the figure are two hypothetical 3-bit converters, one of each type. For simplicity, we’ll assume a straight binary encoding on the digital side, with ‘000’ corresponding to the smallest output and ‘111’ the largest. Other converters may use a signed or offset binary representation, or other more complex codes (PDF). Either way, the digital side, be it input or output, is pretty straightforward. In the case of an N-bit straight binary converter, the digital side consists of 2^N values, from 0 to 2^N-1. Note that 2^N itself is not in the set; our 3-bit converter stops at 7.

The analog side, on the other hand, can be more complex. For starters, the analog quantity can be a voltage, a current, or in the case of digital potentiometers, a resistance. In the case of voltage or current converters, the output may be single ended — that is, carried on a single wire — or differential, with the analog quantity being the difference between two inputs or outputs. But, underlying this diversity is a common set of properties — and specifications — that’s important for understanding and applying these converters.
Digital To Analog
For the simple 3-bit DAC described above, we can create an idealized plot of the transfer function — this is simply the relationship of input (a digital value) to output (an analog value). The digital value, on the x-axis, obviously takes on only certain values, indicated in binary on the plot. The y-axis is a little more confusing. It’s common in specifications to describe the analog side in units of LSB, corresponding to the smallest step of the converter — in other words, units of the analog value of the least significant bit. This at first seems like an odd way to describe an analog quantity, but there’s a good reason for it.

Almost all converters allow the designer to specify a reference value for the full-scale output. For instance, we might choose the full-scale output of a DAC to be 7 V in one circuit. In that case, the LSB would be 1 V. Also note that to get a 7 V full-scale output, we must use an 8 V reference voltage for the DAC: the maximum output is Vref * x / 2^N, where x is the binary input code. Note that your converter may vary: always read the datasheet to be sure.

In another circuit using this example DAC, we might choose a full-scale value of 3.5 V, so the LSB would be 0.5 V. So, the real-world resolution of the converter depends on the reference voltage. As it turns out, a number of other important parameters — especially errors — also depend on the reference, so listing them in LSB units in the datasheet allows an easy comparison and conversion to real-world units: a simple multiply does it.
Errors
One of the places you’ll see LSB units turning up is in non-linearity error specifications. Shown below is an excerpt from the datasheet for my go-to DAC for low-frequency use, the 12-bit voltage-output MCP4821 (PDF) from Microchip (they use LSb with a lower-case “b”, but I won’t hold it against them). Two other new terms also show up here — INL, or integral non-linearity, and DNL, or differential non-linearity. Even though they sound like you’ll have to dust off your old calculus textbook, don’t worry, these are both simple concepts.

DNL is simply the difference between an ideal LSB valued step size and what you’ll actually see from the device. In the case of the MCP4821, the ±0.25 LSB specification says that the actual step sizes will all be between 0.75 LSB and 1.25 LSB. In our 3-bit/7 V converter example, we can expect each step to be between 0.75 V and 1.25 V. (Footnote to the pedantic: the DNL specification is in the “typical” column of the datasheet, so you may actually see better or worse values). For large values of DNL, exceeding 1 LSB, the DAC can become non-monotonic, meaning that the output may decrease as the input increases in some interval; this is definitely something you need to be aware of.

INL, on the other hand, measures the maximum difference between an ideal straight-line transfer function and the actual one. For example, if the actual points lie along a curved or irregular path, the INL tells you how far off from the ideal value you can be at any point. For example, the ±4 LSB INL spec above would be terrible for our toy 3-bit / 7V converter, implying the output could be off by up to 4 V. For a 12-bit DAC, however, this is a much more respectable spec, implying less than 0.1% error (4 / 4095). Don’t make the mistake of taking ±4 LSB and interpreting this as four bits, or 2⁴ = 16 steps.
Analog to Digital
In the case of ADCs, the inputs and outputs take on reversed roles as shown in the plot of the transfer function for our toy 3-bit ADC. Now, the inputs are described in units of LSB, which may be voltage or current, and the output is a digital value, in this case a straight binary representation. As one would expect, the output code changes in jumps as the input value crosses successive thresholds. What may not be obvious at first is that the ideal thresholds are at half-steps, and the input range corresponding to the smallest and largest digital outputs are half the size of the others. The threshold between ‘000’ and ‘001’, for instance is set at 1/2 LSB. This minimizes the error in the conversion; you can think of this as “rounding” to the nearest output value.

Note that if we want our LSB value to be 1 V for this example ADC, we use an 8 V reference voltage. This sets the lowest threshold at 0.5 V, and the largest threshold at 6.5 V. This is a typical arrangement for ADCs, but this is not always the case; some converters have their thresholds at integer multiples of LSB. Always read the datasheet for your part to see exactly how it works.

DNL and INL errors are also specified for ADCs. In this case, the DNL error value specifies the maximum distance between thresholds for successive output values — in other words, the width of the steps in the graph. Again, values of DNL greater than 1 LSB can be problematic in ADCs, causing a symptom known as missing codes: the output may skip certain digital values entirely. As with DACs, in ADCs, INL error tells you the maximum distance of any threshold to the ideal straight line conversion, in other words, how far away from the expected value you can be.

There’s another “error” associated with ADCs: quantization error. I’ve thrown quotes around the word here because quantization error isn’t a deviation from the ideal ADC model. Instead, it’s simply a result of the discrete digital steps of the output. Since the input can have any analog value, there can be up to 1/2 LSB of error when this is converted to a digital value in discrete steps. For instance, an analog input value of 1/2 LSB plus an arbitrarily tiny amount will be converted as digital ‘001’, while an input of 1/2 LSB minus an arbitrarily tiny amount will be converted as ‘000’. Either one differs from the original input value by around 1/2 LSB.
Gain and Offset Error
The final two errors you’re likely to see mentioned are gain and offset. Offset error is easy to visualize: the zero point on either transfer function may not correspond to zero in the analog world; a voltage DAC with a digital input of zero may output a non-zero voltage. Gain errors, on the other hand, represent the difference from an ideal transfer slope of 1. For instance, if a voltage-output DAC has an integrated buffer amplifier, the amplifier may not have a gain of exactly 1; in this case, the buffer will cause the output to be high or low, depending on the actual amplifier gain. This is also where errors in a reference voltage show up.

The good thing about gain and offset errors is that they can be easily “calibrated out.” With two measurements of the system, you can determine the actual gain and offset values, and use these values to correct the errors in software. In fact, these are typically the only two errors that you’ll commonly see corrected; for the others, you’ll typically choose a better converter if you need it. TI has a nice video explaining how to do this calibration.
The Bottom Line
So, that’s a quick run-through of the DC (direct current) part of ADC and DAC specifications: the take away should be that you can understand the error in an ADC or DAC by examining the gain, offset, and INL specifications. Hopefully, this gives you enough as a starting point for digging in when you need to. If you want to delve into the details, there are a number of good references published by semiconductor manufacturers. TI’s Understanding Data Converters (PDF) is a great start; Microchip also has a good explanation on their site.

Tags: engineering
8:30
DIY Video Microscopy
» ‎ Hack a Day

Owning a Microscope is great fun as a hobby in general, but for hackers, it is a particularly useful instrument for assembly and inspection, now that we are building hardware with “grain of sand” sized components in our basements and garages. [voidnill] was given an Eduval 4 microscope by a well-meaning friend during a holiday trip. This model is pretty old, but it’s a Carl Zeiss after all, made in Jena in the erstwhile GDR. Since an optical microscope was of limited use for him, [voidnill] set about digitizing it.

He settled on the Raspberry-Pi route. The Pi and a hard disk were attached directly to the frame of the microscope, and a VGA display connected via a converter. Finally, the Pi camera was jury-rigged to one of the eyepieces using some foam. It’s a quick and dirty hack, and not the best solution, but it works well for [voidnill] since he wanted to keep the original microscope intact.

The standard Pi camera has a wide angle lens. It is designed to capture a large image and converge it on to the small sensor area. Converting it to macro mode is possible, but requires a hack. The lens is removed and ‘flipped over’, and fixed at a distance away from the sensor – usually with the help of an extension tube. This allows the lens to image a very small area and focus it on the (relatively) large sensor. This hack is used in the “OpenFlexure” microscope project, which you can read about in the post we wrote earlier this year or at this updated link. If you want even higher magnification and image quality, OpenFlexure provides a design to mate the camera sensor directly to an RMS threaded microscope objective. Since earlier this year, this open source microscope project has made a lot of progress, and many folks around the world have successfully built their own versions. It offers a lot of customisation options such as basic or high-resolution optics and manual or motorised stages, which makes it a great project to try out.

If the OpenFlexure project proves to be an intimidating build, you can try something easier. Head over to the PublicLab where [partsandcrafts] shows you how to “Build a Basic Microscope with Raspberry Pi”. It borrows from other open source projects but keeps things simpler making it much easier to build.

In the video embed below, [voidnill] gives a brief overview (in German) of his quick hack. If you’ve got some microscope hacks, or have built one of your own, let us know in the comments section.

Tags: Hardware

8:10
Adobe Acrobat Reader DC For Windows JP2 Stream Buffer Overflow
» ‎ Packet Storm Security Exploits

Adobe Acrobat Reader DC for Windows suffers from a heap-based buffer overflow vulnerability that can be leveraged via malformed JP2 streams.
Tags:

8:10
Adobe Acrobat Reader DC For Windows JP2 Stream Buffer Overflow
» ‎ Packet Storm Security Recent Files

Adobe Acrobat Reader DC for Windows suffers from a heap-based buffer overflow vulnerability that can be leveraged via malformed JP2 streams.
Tags:

8:10
Adobe Acrobat Reader DC For Windows JP2 Stream Buffer Overflow
» ‎ Packet Storm Security Misc. Files

Adobe Acrobat Reader DC for Windows suffers from a heap-based buffer overflow vulnerability that can be leveraged via malformed JP2 streams.
Tags:

8:09
Debian Security Advisory 4544-1
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 4544-1 - X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash.
Tags:

8:09
Debian Security Advisory 4544-1
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 4544-1 - X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash.
Tags:

8:09
Debian Security Advisory 4544-1
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 4544-1 - X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash.
Tags:

8:09
Red Hat Security Advisory 2019-3128-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3128-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include deserialization and null pointer vulnerabilities.
Tags:

8:09
Red Hat Security Advisory 2019-3128-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3128-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include deserialization and null pointer vulnerabilities.
Tags:

8:09
Red Hat Security Advisory 2019-3128-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3128-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include deserialization and null pointer vulnerabilities.
Tags:

8:09
Accounts Accounting 7.02 Cross Site Scripting
» ‎ Packet Storm Security Exploits

Accounts Accounting version 7.02 suffers from a persistent cross site scripting vulnerability.
Tags:

8:09
Accounts Accounting 7.02 Cross Site Scripting
» ‎ Packet Storm Security Recent Files

Accounts Accounting version 7.02 suffers from a persistent cross site scripting vulnerability.
Tags:

8:09
Accounts Accounting 7.02 Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

Accounts Accounting version 7.02 suffers from a persistent cross site scripting vulnerability.
Tags:

8:06
Red Hat Security Advisory 2019-3089-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3089-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

8:06
Red Hat Security Advisory 2019-3089-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3089-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

8:06
Red Hat Security Advisory 2019-3089-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3089-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

8:05
LiteManager 4.5.0 romservice Unquoted Service Path
» ‎ Packet Storm Security Exploits

LiteManager version 4.5.0 suffers from a romservice unquoted service path vulnerability.
Tags:

8:05
LiteManager 4.5.0 romservice Unquoted Service Path
» ‎ Packet Storm Security Recent Files

LiteManager version 4.5.0 suffers from a romservice unquoted service path vulnerability.
Tags:

8:05
LiteManager 4.5.0 romservice Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

LiteManager version 4.5.0 suffers from a romservice unquoted service path vulnerability.
Tags:

8:04
Debian Security Advisory 4509-3
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 4509-3 - It was reported that the apache2 update released as DSA 4509-1 incorrectly fixed CVE-2019-10092. Updated apache2 packages are now available to correct this issue.
Tags:

8:04
Debian Security Advisory 4509-3
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 4509-3 - It was reported that the apache2 update released as DSA 4509-1 incorrectly fixed CVE-2019-10092. Updated apache2 packages are now available to correct this issue.
Tags:

8:04
Debian Security Advisory 4509-3
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 4509-3 - It was reported that the apache2 update released as DSA 4509-1 incorrectly fixed CVE-2019-10092. Updated apache2 packages are now available to correct this issue.
Tags:

8:03
Solaris 11.4 xscreensaver Privilege Escalation
» ‎ Packet Storm Security Exploits

Solaris version 11.4 xscreensaver local privilege escalation exploit.
Tags:

8:03
Solaris 11.4 xscreensaver Privilege Escalation
» ‎ Packet Storm Security Recent Files

Solaris version 11.4 xscreensaver local privilege escalation exploit.
Tags:

8:03
Solaris 11.4 xscreensaver Privilege Escalation
» ‎ Packet Storm Security Misc. Files

Solaris version 11.4 xscreensaver local privilege escalation exploit.
Tags:

8:00
WordPress Broken Link Checker 1.11.8 Cross Site Scripting
» ‎ Packet Storm Security Exploits

WordPress Broken Link Check plugin version 1.11.8 suffers from a cross site scripting vulnerability.
Tags:

8:00
WordPress Broken Link Checker 1.11.8 Cross Site Scripting
» ‎ Packet Storm Security Recent Files

WordPress Broken Link Check plugin version 1.11.8 suffers from a cross site scripting vulnerability.
Tags:

8:00
WordPress Broken Link Checker 1.11.8 Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

WordPress Broken Link Check plugin version 1.11.8 suffers from a cross site scripting vulnerability.
Tags:

7:59
Mikogo 5.2.2.150317 Mikogo-Service Unquoted Service Path
» ‎ Packet Storm Security Exploits

Mikogo version 5.2.2.150317 suffers from a Mikogo-Service unquoted service path vulnerability.
Tags:

7:59
Mikogo 5.2.2.150317 Mikogo-Service Unquoted Service Path
» ‎ Packet Storm Security Recent Files

Mikogo version 5.2.2.150317 suffers from a Mikogo-Service unquoted service path vulnerability.
Tags:

7:59
Mikogo 5.2.2.150317 Mikogo-Service Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

Mikogo version 5.2.2.150317 suffers from a Mikogo-Service unquoted service path vulnerability.
Tags:

7:57
Tomedo Server 1.7.3 Information Disclosure / Weak Cryptography
» ‎ Packet Storm Security Exploits

Tomedo Server version 1.7.3 suffers from using weak cryptography for passwords and cleartext transmission of sensitive information vulnerabilities.
Tags:

7:57
Tomedo Server 1.7.3 Information Disclosure / Weak Cryptography
» ‎ Packet Storm Security Recent Files

Tomedo Server version 1.7.3 suffers from using weak cryptography for passwords and cleartext transmission of sensitive information vulnerabilities.
Tags:

7:57
Tomedo Server 1.7.3 Information Disclosure / Weak Cryptography
» ‎ Packet Storm Security Misc. Files

Tomedo Server version 1.7.3 suffers from using weak cryptography for passwords and cleartext transmission of sensitive information vulnerabilities.
Tags:

7:54
CyberArk Password Vault 10.6 Authentication Bypass
» ‎ Packet Storm Security Exploits

CyberArk Password Vault version 10.6 suffers from an authentication bypass vulnerability.
Tags:

7:54
CyberArk Password Vault 10.6 Authentication Bypass
» ‎ Packet Storm Security Recent Files

CyberArk Password Vault version 10.6 suffers from an authentication bypass vulnerability.
Tags:

7:54
CyberArk Password Vault 10.6 Authentication Bypass
» ‎ Packet Storm Security Misc. Files

CyberArk Password Vault version 10.6 suffers from an authentication bypass vulnerability.
Tags:

7:53
Linux/x86 Add User To /etc/passwd Shellcode
» ‎ Packet Storm Security Recent Files

74 bytes small add user User to /etc/passwd shellcode.
Tags:

7:53
Linux/x86 Add User To /etc/passwd Shellcode
» ‎ Packet Storm Security Misc. Files

74 bytes small add user User to /etc/passwd shellcode.
Tags:

7:52
Linux/x86 execve /bin/sh Shellcode
» ‎ Packet Storm Security Recent Files

25 bytes small Linux/x86 execve /bin/sh shellcode.
Tags:

7:52
Linux/x86 execve /bin/sh Shellcode
» ‎ Packet Storm Security Misc. Files

25 bytes small Linux/x86 execve /bin/sh shellcode.
Tags:

7:50
Linux/x86 Reverse Shell NULL Free 127.0.0.1:4444 Shellcode
» ‎ Packet Storm Security Recent Files

91 bytes small Linux/x86 reverse shell NULL free 127.0.0.1:4444 shellcode.
Tags:

7:50
Linux/x86 Reverse Shell NULL Free 127.0.0.1:4444 Shellcode
» ‎ Packet Storm Security Misc. Files

91 bytes small Linux/x86 reverse shell NULL free 127.0.0.1:4444 shellcode.
Tags:

7:49
X.Org X Server 1.20.4 Local Stack Overflow
» ‎ Packet Storm Security Exploits

X.Org X Server version 1.20.4 suffers from a local stack overflow vulnerability.
Tags:

7:49
X.Org X Server 1.20.4 Local Stack Overflow
» ‎ Packet Storm Security Recent Files

X.Org X Server version 1.20.4 suffers from a local stack overflow vulnerability.
Tags:

7:49
X.Org X Server 1.20.4 Local Stack Overflow
» ‎ Packet Storm Security Misc. Files

X.Org X Server version 1.20.4 suffers from a local stack overflow vulnerability.
Tags:

7:47
Whatsapp 2.19.216 Remote Code Execution
» ‎ Packet Storm Security Exploits

Whatsapp version 2.19.216 suffers from a remote code execution vulnerability.
Tags:

7:47
Whatsapp 2.19.216 Remote Code Execution
» ‎ Packet Storm Security Recent Files

Whatsapp version 2.19.216 suffers from a remote code execution vulnerability.
Tags:

7:47
Whatsapp 2.19.216 Remote Code Execution
» ‎ Packet Storm Security Misc. Files

Whatsapp version 2.19.216 suffers from a remote code execution vulnerability.
Tags:

7:46
Lavasoft 2.3.4.7 LavasoftTcpService Unquoted Service Path
» ‎ Packet Storm Security Exploits

Lavasoft version 2.3.4.7 suffers from a LavasoftTcpService unquoted service path vulnerability.
Tags:

7:46
Lavasoft 2.3.4.7 LavasoftTcpService Unquoted Service Path
» ‎ Packet Storm Security Recent Files

Lavasoft version 2.3.4.7 suffers from a LavasoftTcpService unquoted service path vulnerability.
Tags:

7:46
Lavasoft 2.3.4.7 LavasoftTcpService Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

Lavasoft version 2.3.4.7 suffers from a LavasoftTcpService unquoted service path vulnerability.
Tags:

7:45
Sextortion Botnet Spreads 30,000 Emails An Hour
» ‎ Packet Storm Security Headlines

Sextortion Botnet Spreads 30,000 Emails An Hour
Tags: headlineemailcybercrimebotnetfraud
7:44
US Claims Cyber Strike On Iran After Attack On Saudi Oil Facility
» ‎ Packet Storm Security Headlines

US Claims Cyber Strike On Iran After Attack On Saudi Oil Facility
Tags: headlinegovernmentusacyberwariransaudi arabia
7:44
Fraud Bazaar Selling Stolen Payment Cards Heisted For 26 Million Cards
» ‎ Packet Storm Security Headlines

Fraud Bazaar Selling Stolen Payment Cards Heisted For 26 Million Cards
Tags: headlinehackerbankcybercrimedata lossfraud
7:44
Pentagon Hack The Proxy Program Uncovers 31 Vulnerabilities
» ‎ Packet Storm Security Headlines

Pentagon Hack The Proxy Program Uncovers 31 Vulnerabilities
Tags: headlinehackergovernmentusaflawcyberwarmilitary

7:18
[SECURITY] [DSA 4509-3] apache2 security update
» ‎ Bugtraq

Posted by Salvatore Bonaccorso on Oct 16
-------------------------------------------------------------------------
Debian Security Advisory DSA-4509-3 security () debian org
https://www.debian.org/security/ Salvatore Bonaccorso
October 15, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : apache2
CVE ID : CVE-2019-10092
Debian Bug :...

Tags:
7:14
[SECURITY] [DSA 4544-1] unbound security update
» ‎ Bugtraq

Posted by Sebastien Delafond on Oct 16
-------------------------------------------------------------------------
Debian Security Advisory DSA-4544-1 security () debian org
https://www.debian.org/security/ Sebastien Delafond
October 16, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : unbound
CVE ID : CVE-2019-16866
Debian Bug :...

Tags:
7:11
CVE-2019-3010 - Local privilege escalation on Solaris 11.x via xscreensaver
» ‎ Bugtraq

Posted by Marco Ivaldi on Oct 16
Dear Bugtraq,

Please find attached an advisory for the following vulnerability, fixed in Oracle's Critical Patch Update (CPU) of
October 2019:

"Exploitation of a design error vulnerability in xscreensaver, as distributed with Solaris 11.x, allows local attackers
to create (or append to) arbitrary files on the system, by abusing the -log command line switch introduced in version
5.06. This flaw can be leveraged to cause a denial of...

Tags:

7:00
Pack Your Bags – Systemd Is Taking You To A New Home
» ‎ Hack a Day

Home directories have been a fundamental part on any Unixy system since day one. They’re such a basic element, we usually don’t give them much thought. And why would we? From a low level point of view, whatever location $HOME is pointing to, is a directory just like any other of the countless ones you will find on the system — apart from maybe being located on its own disk partition. Home directories are so unspectacular in their nature, it wouldn’t usually cross anyone’s mind to even consider to change anything about them. And then there’s Lennart Poettering.

In case you’re not familiar with the name, he is the main developer behind the systemd init system, which has nowadays been adopted by the majority of Linux distributions as replacement for its oldschool, Unix-style init-system predecessors, essentially changing everything we knew about the system boot process. Not only did this change personally insult every single Perl-loving, Ken-Thompson-action-figure-owning grey beard, it engendered contempt towards systemd and Lennart himself that approaches Nickelback level. At this point, it probably doesn’t matter anymore what he does next, haters gonna hate. So who better than him to disrupt everything we know about home directories? Where you _live_?

Although, home directories are just one part of the equation that his latest creation — the systemd-homed project — is going to ~~make people hate him even more~~ tackle. The big picture is really more about the whole concept of user management as we know it, which sounds bold and scary, but which in its current state is also a lot more flawed than we might realize. So let’s have a look at what it’s all about, the motivation behind homed, the problems it’s going to both solve and raise, and how it’s maybe time to leave some outdated philosophies behind us.

A Quick Introduction To Systemd
Just one more module… Image: Shmuel Csaba Otto Traian [CC BY-SA 3.0], via Wikimedia CommonsBefore we get into the homed part of the endeavor, let’s bring everyone on the same page about systemd itself. In simple words, systemd handles everything that lies beyond the kernel’s tasks to start up the system: setting up the user space and providing everything required to get all system processes and daemons running, and managing those processes along the way. It’s both replacing the old init process running with PID 1, and providing an administrative layer between the kernel and user space, and as such, is coming with a whole suite of additional tools and components to achieve all that: system logger, login handling, network management, IPC for communication between each part, and so on. So, what was once handled by all sorts of single-purpose tools has since become part of systemd itself, which is one source of resentment from people latching on to the “one tool, one job” philosophy.

Technically, each tool and component in systemd is still shipped as its own executable, but due to interdependency of these components they’re not really that standalone, and it’s really more just a logical separation. systemd-homed is therefore one additional such component, aimed to handle the user management and the home directories of those users, tightly integrated into the systemd infrastructure and all the additional services it provides.

But why change it at all? Well, let’s have a look at the current way users and home directories are handled in Linux, and how systemd-homed is planning to change that.
The Status Quo Of $HOME And User Management
Since the beginning of time, users have been stored in the /etc/passwd file, which includes among other things the username, a system-unique user id, and the home directory location. Traditionally, the user’s password was also stored in hashed form in that file — and it might still be the case on some, for example embedded systems — but was eventually moved to a separate /etc/shadow file, with more restricted file permissions. So, after successfully logging in to the system with the password found in the shadow file, the user starts off in whichever location the home directory entry in /etc/passwd is pointing to.
Sure you want to live here? “Rosedale home”by Sheba_Also, CC BY-SA 2.0
In other words, for the most fundamental process of logging in to a system, three individual parts that are completely independent and separated from each other are required. Thanks to well-defined rules that stem from simpler times and have since remained mostly untouched, and which every system and tool involved in the process commendably abides by, this has worked out just fine. But if we think about it: is this really the best possible approach?

Note that this is just the most basic local user login. Throw in some network authentication, additional user-based resource management, or disk encryption, and you will notice that /etc/passwd isn’t the place for any of that. And well, why would it be — one tool, one job, right? As a result, instead of configuring everything possibly related to a user in one centralized user management system that is flexible enough for any present and future considerations, we just stack dozens of random configurations on top of and next to each other, with each one of them doing their own little thing. And we are somehow perfectly fine and content with that.

Yet, if you had to design a similar system today from scratch, would you really opt for the same concept? Would your system architect, your teacher, or even you yourself really be fine with duplicate database entries (usernames both in passwd and shadow file), unenforced relationships (home directory entry and home directory itself), and just random additional data without rhyme or reason: resource management, PAM, network authentication, and so on? Well, as you may have guessed by now, Lennart Poettering isn’t much a fan of that, and with systemd-homed he is aiming to unite all the separate configuration entities around user management into one centralized system, flexible enough to handle everything the future might require.
Knock Knock – It’s Systemd
So instead of each component having its own configuration for all users, systemd-homed is going to collect all the configuration data of each component based on the user itself, and store it in a user-specific record in form of a JSON file. The file will include all the obvious information such as username, group membership, and password hashes, but also any user-dependent system configurations and resource management information, and essentially really just anything relevant. Being JSON, it can virtually contain whatever you want to put there, meaning it is easily extendable whenever new features and capabilities are required. No need to wonder anymore which of those three dozen files you need to touch if you want to change something.

In addition to user and user-based system management, the home directory itself will be linked to it as a LUKS encrypted container — and this is where the interesting part comes, even if you don’t see a need for a unified configuration place: the encryption is directly coupled to the user login itself, meaning not only is the disk automatically decrypted once the user logs in, it is equally automatic encrypted again as soon as the user logs out, locks the screen, or suspends the device. In other words, your data is inaccessible and secure whenever you’re not logged in, while the operating system can continue to operate independently from that.

There is, of course, one downside to that.
Chicken / Egg Problem With SSH
If the home directory requires an actively logged-in user to decrypt the home directory, there’s going to be a problem with remote logins via SSH that depend on the SSH decryption key found inside the (at that point encrypted) home directory. For that reason, SSH simply won’t work without a logged in local user, which of course defies the whole point of remote access.
The OpenSSH logo.
That being said, it’s worth noting that at this stage, systemd-homed is focusing mostly on regular, real human users on a desktop or laptop, and not so much system or service-specific users, or anything running remotely on a server. That sounds of course like a bad excuse, but keep also in mind that systemd-homed will change the very core of user handling, so it’s probably safe to assume that future iterations will diminish that separation and things will work properly for either type of user. I mean, no point to reinvent the wheel if you need to keep the old one around as well — but feel free to call me naive here.

Ideally, the SSH keys would be migrated to the common-place user management record, but that would require some work on SSH’s side. This isn’t happening right now, but then again, systemd-homed itself is also just a semi-implemented idea in a git branch at this point. It’s unlikely going to be widely adapted and forced onto you by the evil Linux distributions until this issue in particular is solved — but again, maybe I’m just overly optimistically naive.
Self-Contained Users With Portable Homes
But with user management and home directory handling in a single place and coupled together, you can start to dream of additional possible features. For instance, portable home directories that double as self-contained users. What that means is that you could keep the home directory for example on a USB stick or external disk, and seamlessly move it between, say, your workstation at home and your laptop whenever you’re on the move. No need to duplicate or otherwise sync your data, it’s all in one place with you. This brings security and portability benefits.
Or would you rather live here? By ltenney1225 CC BY-NC 2.0
But that’s not all. It wouldn’t have to be your own device you can attach your home directory to, it could be a friend’s device or the presenter laptop at a conference or really any compatible device. As soon as you plug in your home directory into it, your whole user will automatically exist on that device as well. Well, sort of automatically. Obviously, no one would want some random people roaming around on their system, so the system owner / superuser will still have to grant you access to their system first, with a user and resource configuration based on their own terms, and signed to avoid tempering.

Admittedly, for some of you, this might all sound less like amazing new features and more like a security nightmare and mayhem just waiting to happen. And it most certainly will bring a massive change to yet another core element of Linux where a lot could possibly go wrong. How it will all play out in reality remains to be seen. Clearly it won’t happen over night, and it won’t happen out of nowhere either — the changes are just too deep and fundamental. But being part of systemd itself, and seeing its influence on Linux, one has to entertain the idea that this might happen one day in the not too distant future. And maybe it should.
Times Are Changing
Yes, this will disrupt everything we know about user management. And yes, it goes against everything Unix stands for. But it also gets rid of an ancient concept that goes against everything the software engineering world has painfully learned as best practices over all these decades since. After all, it’s neither the 70s nor the 80s anymore. We don’t have wildly heterogeneous environments anymore where we need to find the least capable common denominator for each and every system anymore. Linux is the dominant, and arguably the only really relevant open source “Unix” system nowadays — even Netflix and WhatsApp running FreeBSD is really more anecdotal in comparison. So why should Linux really care about compatibility with “niche” operating systems that are in the end anyway going to do their own thing? And for that matter, why should we still care about Unix altogether?

It generally begs the question, why do we keep on insisting that computer science as a discipline has reached its philosophical peak in a time the majority of its current practitioners weren’t even born yet? Why are we so frantically holding on to a philosophy that was established decades before the world of today with its ubiquitous internet, mobile connectivity, cloud computing, Infrastructure/Platform/Software/Whatnot-as-a-Service, and everything on top and below that has become reality? Are we really that nostalgic about the dark ages?

I’m not saying that the complexity we have reached with technology is necessarily an outcome we should have all hoped for, but it is where we are today. And it’s only going to get worse. The sooner we accept that and move on from here, and maybe adjust our ancient philosophies along the way, the higher the chance that we will actually manage to tame this development and keep control over it.

Yes, change is a horrible, scary, and awful thing if it’s brought upon us by anyone else but ourselves. But it’s also inevitable, and systemd-homed might just be the proverbial broken egg that will give us a delicious omelette here. Time will tell.

Tags: featured
4:00
A Tamagotchi for WiFi Cracking
» ‎ Hack a Day

OK, let’s start this one by saying that it’s useful to know how to break security measures in order to understand how to better defend yourself, and that you shouldn’t break into any network you don’t have access to. That being said, if you want to learn about security and the weaknesses within the WPA standard, there’s no better way to do it than with a tool that mimics the behavior of a Tamagotchi.

Called the pwnagotchi, this package of artificial intelligence looks for information in local WiFi packets that can be used to crack WPA encryption. It’s able to modify itself in order to maximize the amount of useful information it’s able to obtain from whatever environment you happen to place it in. As an interesting design choice, the pwnagotchi behaves like an old Tamagotchi pet would, acting happy when it gets the inputs it needs.

This project is beyond a novelty though and goes deep in the weeds of network security. If you’re at all interested in the ways in which your own networks might be at risk, this might be a tool you can use to learn a little more about the ways of encryption, general security, and AI to boot. Of course, if you’re new to the network security world, make sure the networks you’re using are secured at least a little bit first.

Thanks to [Itay] for the tip!

Tags: security hacks

3:33
Zilab Remote Console Server 3.2.9 zrcs Unquoted Service Path
» ‎ Packet Storm Security Exploits

Zilab Remote Console Server version 3.2.9 suffers from a zrcs unquoted service path vulnerability.
Tags:

3:33
Zilab Remote Console Server 3.2.9 zrcs Unquoted Service Path
» ‎ Packet Storm Security Recent Files

Zilab Remote Console Server version 3.2.9 suffers from a zrcs unquoted service path vulnerability.
Tags:

3:33
Zilab Remote Console Server 3.2.9 zrcs Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

Zilab Remote Console Server version 3.2.9 suffers from a zrcs unquoted service path vulnerability.
Tags:

1:00
Cordless Drill Sprouts Wings And Takes Flight
» ‎ Hack a Day

Brushless motors and lithium batteries were a revolution for remote control aircraft. No longer would nitro engines rule the roost, as flying became far cheaper and more accessible almost overnight. The same technology has also found its way into power tools, leading to [Peter Sripol] deciding to build a powerdrill into a flying aircraft in this video, embedded below.

An unmodified DeWalt drill is the heart of the build, serving as the propulsion unit of the craft. A servo is used to actuate the drill’s trigger to serve as the throttle. As power drills are geared down significantly compared to a typical hobby brushless motor, it was necessary to use a much larger prop than would be usual. This was custom machined out of wood with the help of [William Osman], and despite some mishaps, came out (mostly) in one piece. The airframe consists of foam wings with poplar spars, and an aluminium extrusion serves as the tail boom. A few 3D printed parts then tie everything together.

Despite the weight of the drill, the hacked-together craft is able to fly quite easily. The large wings and propeller help to make up for the shortcomings of the powertrain. Unfortunately, there wasn’t quite enough surplus lift to carry a payload of smartphones to capture in-flight footage, but overall the project could be considered a resounding success.

We’ve seen [Peter]’s work before, too – sometimes even putting himself in the pilots seat! Video after the break.

Tags: tool hacks

October 15, 2019
22:59
reinersct: receiving annual awards for trivial insecurity
» ‎ Full Disclosure

Posted by Thegirl Wholearnedtocode on Oct 15
https://www.reiner-sct.com/lang/en/search.html?m=all&q="><marquee>&dosubmit=submit

I have to unfortunately use their products via another "security" vendor.
If anyone knows them, feel free to reach out and help them.

Tags:
22:58
Tomedo Server - Weak encryption mech.
» ‎ Full Disclosure

Posted by ProSec Security Team on Oct 15
Hello together,

we’ve found the following vulnerability below.

Affected software: Tomedo Server 1.7.3
Vulnerability type: Cleartext Transmission of Sensitive Information & Weak Cryptography for Passwords
Vulnerable version: Tomedo Server 1.7.3
Vulnerable component: Customer Tomedo Server that communicates with Vendor Tomedo Update Server
Vendor report confidence: Confirmed
Fixed version: Version later then 1.7.3
Vendor notification:...

Tags:
22:57
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 15
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu

Swift 5.1.1 for Ubuntu is now available and addresses the following:

Foundation
Available for: Ubuntu 14.04, 16.04 and 18.04
Impact: Incorrect management of file descriptors in URLSession could
lead to inadvertent data disclosure
Description: This issue was addresses by updating incorrect
URLSession file descriptors management logic to match Swift 5.0.
CVE-2019-8790: Apple

Installation note:

Swift...

Tags:
22:57
Reflected XSS via Broken Link Checker v.1.11.8 WordPress Plugin
» ‎ Full Disclosure

Posted by Ismail Doe on Oct 15
Document Title
===============
Reflected XSS via `Broken Link Checker` v.1.11.8 WordPress plugin.

Product Description
===============
Broken Link Checker will monitor your blog looking for broken links and let
you know if any are found.

Homepage: https://managewp.com/
WordPress Plugin: https://wordpress.org/plugins/broken-link-checker/

PoC
===============

1) Login to your wordpress webpage
2) Navigate to the following page (Make sure the...

Tags:
22:56
[CFP] BSides San Francisco – February 2020
» ‎ Full Disclosure

Posted by BSidesSF CFP via Fulldisclosure on Oct 15
BSidesSF is soliciting presentations and workshops for the 2020 annual
BSidesSF conference.

CFP: https://bsidessf.org/cfp.html

** Topics **

All topic areas related to reliability, network security, privacy,
cryptography, and information security are of interest and in scope.

Let us help you get the word out on The Next Big Thing!

** Theme **

San Francisco, to celebrate BSidesSF's 10th anniversary

** Submission **...

Tags:

22:00
Recreating Lord Nikon’s Laptop From Hackers
» ‎ Hack a Day

The outlandish computers from 1995’s Hackers are easily one of the most memorable elements of the iconic cult classic. In the film, each machine is customized to reflect the individual hacker that operates it, and feature everything from spray painted camouflage paint schemes to themed boot animations based on the owner’s personal iconography. But what might not so obvious is that the real-life props took a considerable amount of hardware hacking before they were ready for their big-screen debut.

A group of dedicated Hackers fans have created a website to document, and ideally recreate, all the custom work that went into the various pieces of tech featured in the film. As explained by [Nandemoguy], the group’s latest triumph is a screen-accurate build of Lord Nikon’s laptop. The final product not only looks just like the machine used in the film, but thanks to the internal Raspberry Pi, is far more powerful than the original computer would have been.

Unless you’re on the team over at HackersCurator.com, you might not know that the laptops in the film were handmade chimeras that combined the external cases of various PCs with (usually) the internals of an Apple Powerbook 180c. Why the prop masters of the film would have gone through so much trouble to create the character’s computers is not immediately clear, but if we had to guess, presumably it was due to the requirements of the over-the-top graphical interfaces that are featured so heavily in the film.

At any rate, the replica created by [Nandemoguy] is built in much the same way. At least for the parts you can see on the outside, anyway. He goes through the considerable case modifications required to replace the original keyboard on the Toshiba Satellite T1850 with a Powerbook keyboard, which as you might have guessed, has been converted into a USB HID device with a Teensy microcontroller. He even cuts the ports off the back of the Mac’s motherboard and glues them in place around the backside of the machine. But everything else, including the LCD, is all new hardware. After all, who really wants to go through all that trouble just to have a fancy Powerbook 180c in 2019?

Even if you weren’t a fan of Hackers, the level of detail and effort put into this build it absolutely phenomenal. It’s interesting to see the parallels between this replica and the burgeoning cyberdeck scene; it seems like with a Teensy, a Raspberry Pi, and enough Bondo, anything can be turned into a functional computer.

Tags: laptops hacks
19:00
Endless Electronic Problems For Solving
» ‎ Hack a Day

We know not everyone who likes to build circuitry wants to dive headfirst into the underlying electrical engineering that makes everything work. However, if you want to, now is a great time. Many universities have most or all of their material online and you can even take many courses for free. If you want an endless pool of solved study problems, check out autoCircuits. It can create many different kinds of electronics problems and their solutions.

You can get a totally random circuit, or choose if you want to focus on DC, AC, two-ports, or several other types of problems. You can also alter the general form of the problem. For example, for a DC analysis, you can have it assign circuit values so that the answer is a value such as 45 ohms, or you can have it just use symbols so that the answer might be i4=V1/4R. You even get to pick the difficulty level and pick certain types of problems to avoid. Just be fast. After the site generates a problem, you have 10 seconds to download it before it is gone forever.

The problems range from simple to complex so for example our first screenshot is an easy one.

The program provides the solution, but this one is pretty easy — you just have to combine the parallel and series resistances. With symbolic resistances, the values might have been things like R, 3R, and 9R. Or you can pick to have non-integers like 0.23R or even rational numbers like 22/5 as the multiplying factor.

The program has one other cool feature: you can input a SPICE netlist to plug in your own circuits. There are some restrictions. For example, you can only have 10 nodes and there are some strict naming conventions. In addition, all component values will be selected randomly.

For an example of the SPICE function, try this netlist:

V_1 1 0 AC
C_1 1 2
C_2 1 2
R_1 2 0
.TRAN Solve V(2,0)

The output looks like the screenshot to the right, although yours will almost certainly have different random values:

If like us, you were too lazy to work it out, the output also shows the answer: v4(t)=(-4.111 cos(9.4t)-4.092 sin(9.4t)). Yeah. That’s what we were thinking.

This would be great if you were teaching electronics, too. You could generate an endless amount of homework or quiz questions. [Stephano] offers the service for free and uses software ranging from MATLAB, BLAG, and LaTeX to do its magic.

If you want to brush up on Spice and using it for analysis, we’ve been there. By the way, the first analysis tool you generally learn is nodal analysis and that would be a good first step to solving these kinds of problems.

Tags: misc hacks
16:00
Solar Powered Weeding Tractor Uses Manual Labour
» ‎ Hack a Day

You might not have realised this, but there’s a group of hackers out there without whom you wouldn’t be able to put food on the table. They hack under the blazing sun and pouring rain, and have been doing it for thousands of years. Known more commonly as farmers, their creative problem solving skills with whatever is lying around can be absolutely jaw dropping. [Andrew Mans] is one such individual. He built a solar powered weeding tractor that uses human labour to do the actual weeding.

We’ll be honest, this made us go “Wait, what?” for a few seconds, until the ingenuity of it all sank in. Crawling at a snails pace across the onion fields at Mans Organics, the contraption allows 3 workers to lie comfortably on their stomachs in a shaded tent, while pulling weeds that grow too close to the crop for conventional mechanised weeding methods. While this might seem like a slightly crappy job at first glance, there are definitely worse jobs a farm (or in an office) and actually looks quite relaxing. While the picking could of course be automated, this is no small task, especially when your business is food production, not robotics.

Power is provided from four 250 W solar panels on the roof, which charge a bank of deep cycle batteries and the drive train. A pure sine wave converter provides power to a 240 V motor driver which turns it back into DC to run the drive motor. [Andrew] admits this back and forth voltage conversion is overcomplicated and inefficient but it’s the sort of thing that quickly happens when you hack a hacked design. The axle and 5-speed gearbox was salvaged from an old 3 ton truck and is mounted vertically to save space. The hydraulic steering is controlled by one of the human weed pickers, who just makes small course corrections as required.

We love the weird combo of old and new in this hack. Check out the machine in action and detailed walk-around after the break.

For true automation we’ve seen more than one agricultural robot, and this year’s Hackaday prize again had an agricultural IoT system in the semi-finals.

Tags: solar hacks

15:24
Ubuntu Security Notice USN-4156-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 4156-1 - It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.
Tags:

15:24
Ubuntu Security Notice USN-4156-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 4156-1 - It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.
Tags:

15:24
Ubuntu Security Notice USN-4156-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 4156-1 - It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.
Tags:

15:22
Red Hat Security Advisory 2019-3067-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3067-01 - Java Security Services provides an interface between Java Virtual Machine and Network Security Services. It supports most of the security standards and encryption technologies supported by NSS including communication through SSL/TLS network protocols. JSS is primarily utilized by the Certificate Server as a part of the Identity Management System. An implicit trust issue has been addressed.
Tags:

15:22
Red Hat Security Advisory 2019-3067-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3067-01 - Java Security Services provides an interface between Java Virtual Machine and Network Security Services. It supports most of the security standards and encryption technologies supported by NSS including communication through SSL/TLS network protocols. JSS is primarily utilized by the Certificate Server as a part of the Identity Management System. An implicit trust issue has been addressed.
Tags:

15:22
Red Hat Security Advisory 2019-3067-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3067-01 - Java Security Services provides an interface between Java Virtual Machine and Network Security Services. It supports most of the security standards and encryption technologies supported by NSS including communication through SSL/TLS network protocols. JSS is primarily utilized by the Certificate Server as a part of the Identity Management System. An implicit trust issue has been addressed.
Tags:

15:22
Red Hat Security Advisory 2019-3055-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3055-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, heap overflow, and use-after-free vulnerabilities.
Tags:

15:22
Red Hat Security Advisory 2019-3055-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3055-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, heap overflow, and use-after-free vulnerabilities.
Tags:

15:22
Red Hat Security Advisory 2019-3055-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3055-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, heap overflow, and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3076-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3076-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3076-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3076-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3076-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3076-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3082-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3082-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3082-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3082-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3082-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3082-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3083-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3083-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3083-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3083-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3083-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3083-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:20
Ubuntu Security Notice USN-4155-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 4155-1 - It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information.
Tags:

15:20
Ubuntu Security Notice USN-4155-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 4155-1 - It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information.
Tags:

15:20
Ubuntu Security Notice USN-4155-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 4155-1 - It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information.
Tags:

15:19
Bolt CMS 3.6.10 Cross Site Request Forgery
» ‎ Packet Storm Security Exploits

Bolt CMS version 3.6.10 suffers from a cross site request forgery vulnerability.
Tags:

15:19
Bolt CMS 3.6.10 Cross Site Request Forgery
» ‎ Packet Storm Security Recent Files

Bolt CMS version 3.6.10 suffers from a cross site request forgery vulnerability.
Tags:

15:19
Bolt CMS 3.6.10 Cross Site Request Forgery
» ‎ Packet Storm Security Misc. Files

Bolt CMS version 3.6.10 suffers from a cross site request forgery vulnerability.
Tags:

15:18
sudo 1.8.28 Security Bypass
» ‎ Packet Storm Security Exploits

sudo version 1.8.28 suffers from a security bypass vulnerability.
Tags:

15:18
sudo 1.8.28 Security Bypass
» ‎ Packet Storm Security Recent Files

sudo version 1.8.28 suffers from a security bypass vulnerability.
Tags:

15:18
sudo 1.8.28 Security Bypass
» ‎ Packet Storm Security Misc. Files

sudo version 1.8.28 suffers from a security bypass vulnerability.
Tags:

15:16
ActiveFax Server 6.92 Build 0316 ActiveFaxServiceNT Unquoted Service Path
» ‎ Packet Storm Security Exploits

ActiveFax Server version 6.92 Build 0316 suffers from an ActiveFaxServiceNT unquoted service path vulnerability.
Tags:

15:16
ActiveFax Server 6.92 Build 0316 ActiveFaxServiceNT Unquoted Service Path
» ‎ Packet Storm Security Recent Files

ActiveFax Server version 6.92 Build 0316 suffers from an ActiveFaxServiceNT unquoted service path vulnerability.
Tags:

15:16
ActiveFax Server 6.92 Build 0316 ActiveFaxServiceNT Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

ActiveFax Server version 6.92 Build 0316 suffers from an ActiveFaxServiceNT unquoted service path vulnerability.
Tags:

13:00
Reverse Engineering Liberates Dash Cam Video
» ‎ Hack a Day

If you’ve purchased a piece of consumer electronics in the last few years, there’s an excellent chance that you were forced to use some proprietary application (likely on a mobile device) to unlock its full functionality. It’s a depressing reality of modern technology, and unless you’re willing to roll your own hardware, it can be difficult to avoid. But [krishnan793] decided to take another route, and reverse engineered his DDPAI dash camera so he could get a live video stream from it without using the companion smartphone application.

Like many modern gadgets, the DDPAI camera creates its own WiFi access point that you need to connect to for configuration. By putting his computer’s wireless card into Monitor mode and running Wireshark, [krishnan793] was able to see that the smartphone was communicating with the camera using some type of REST API. After watching the clear-text exchanges for awhile, he not only discovered a few default usernames and passwords, but the commands necessary to configure the camera and start the video stream.

After hitting it with the proper REST messages, an nmap scan confirmed that several new services had started up on the device. Unfortunately, he didn’t get any video when he pointed VLC to the likely port numbers. At this point [krishnan793] checked the datasheet for the camera’s Hi3516E SoC and saw that it supported H.264 encoding. By manually specifying that as the video codec when invoking VLC, it was able to play a video stream from port 6200. A little later, he discovered that port 6100 was serving up the live audio.

Technically that’s all he wanted to do in the first place, as he was looking to feed the video into OpenCV for other projects. But while he was in the area, [krishnan793] also decided to find the download URL for the camera’s firmware, and ran it through binwalk to see what he could find out. Not surprisingly the security turned out to be fairly lax through the entire device, so he was able to glean some information that could be useful for future projects.

Of course, if you’d rather go with the first option and build your own custom dash camera so you don’t have to jump through so many hoops just to get a usable video stream, we’ve got some good news for you.

Tags: car hacks
11:31
Hackaday Prize China Finalists Announced
» ‎ Hack a Day

In the time since the Hackaday Prize was first run it has nurtured an astonishing array of projects from around the world, and brought to the fore some truly exceptional winners that have demonstrated world-changing possibilities. This year it has been extended to a new frontier with the launch of the Hackaday Prize China (Chinese language, here’s a Google Translate link), allowing engineers, makers, and inventors from that country to join the fun. We’re pleased to announce the finalists, from which a winner will be announced in Shenzhen, China on November 23^rd. If you’re in Shenzen area, you’re invited to attend the award ceremony!

All six of these final project entries have been translated into English to help share information about projects across the language barrier. On the left sidebar of each project page you can find a link back to the original Chinese language project entry. Each presents a fascinating look into what people in our global community can produce when they live at the source of the component supply chain. Among them are a healthy cross-section of projects which we’ll visit in no particular order. Let’s dig in and see what these are all about!

Want To Make A Voice Assistant? First, Make Your Own SBC
We’re used to voice assistants from the likes of Google and Amazon, but [dimension] eschews those by creating their own. It’s a two-PCB device, with a board containing display and sound circuitry mated via a PCI-E connector to a tiny self-designed CPU board which is called the Mini-Pi. This is an Allwinner H3-based SBC which we can imagine having applications beyond this project, but the attention to detail of creating an SBC for the project rather than using one off the shelf is very unexpected. The software is derived from the Jasper project which some readers may already be familiar with, and clearly a lot of effort has been put into making a product rather than a benchtop prototype.
Cleaning Robots In Disguise! This robotic floor sweeper is part hexapod, part wheeled.
If you have a Roomba or similar robotic home cleaner, you’ll be aware of its limitations. Obstacles can defeat it, and any challenges such as stairs or uneven surfaces are beyond it. A home sweeping robot with far more versatility comes from [Lìrèn] and takes the form of a Transformers-style hybrid between the type of wheeled machine that we’re used to and a hexapod walker. An extra twist is that the hexapod can detach itself from the wheeled sweeper to access spaces with restricted height such as beneath furniture. At its heart is a HiKey development board, which (from a bit of Google Translate detective work) we think is based upon a Huawei Kirin 970 SoC.
What would a PDA have looked like using 2019 components? The PDA, Re-Invented
There was a time back in the 1990s when the future of mobile computing seemed to lie in the PDA, relatively low-powered small tablets that held time-management and other productivity apps. All of the PDA’s functions have transferred into the smartphone which has delivered on the promise of those early devices and then some, but perhaps there is still a niche for such a device. It’s an avenue [qwert1213131] is exploring with Jakiro, an ESP32 based device sporting both an eInk touchscreen and a small OLED display. It’s interesting, because by revisiting the idea twenty years later with the benefit of components that simply weren’t available to the designers of the originals it can bring some of what was useful in a PDA such as convenience and simplicity along with the integrated wireless and computing power of the ESP and the low-power persistence of the eInk.
Three-sensor motion capture for your arm Motion Capture For The Rest Of Us
If we think of motion capture, it’s likely that scenes of actors wearing body suits covered in lights spring to mind, in the manner of the systems used for example by CGI artists. But the field of motion capture extends across a multitude of projects and technologies from hacked Nintendo PowerGloves upwards. It’s something [fantc] has made an inroad into, with a one-arm motion capture system using three MPU6050 inertial sensors coupled to an MSP430 family CPU. The whole setup is a compact unit strapped to the arm with a couple of smaller sensor boards, and the interfacing is performed via Bluetooth Low Energy. It doesn’t stretch the imagination to see this approach brought to other limbs with more sensors, perhaps creating full-body motion capture without some of the expensive set-up described earlier.
It’s A Handheld Console, But With So Much More Promise! This Pi Compute Module console board has so much potential!
At first sight, [Counterattack]’s handheld game console appears to be nothing special, after all while it is undoubtedly nicely built, it is not the only such project to be found. It’s only when it’s opened up do we gain an insight into why it deserves a second look. This is a complete and very well executed platform for the Raspberry Pi Compute Module 3. This was selected because it has the power required for the most faithful PlayStation emulation, but because the Pi is such a widely-supported and versatile device in itself we can instantly see huge appeal for this device in a host of applications beyond the world of gaming. Using a Pi ties you to one of the official form factors, and the Compute module offers a chance to roll your own Pi. If we consider this console as a roll-your-own Raspberry Pi 3 for portable battery-powered applications it becomes of interest far beyond a few PlayStation games.
The insect hexapod hardware isn’t the clever part Walking Like An Insect
[HarrytheOrange] brings us a hexapod walker, which would be nothing special were it not that its gait is derived from a study of insect movement rather than from a circular motion. In particular his interest lies in the insect’s ability to retain mobility with less than six operational legs, and he details his rather inhumane research methodology. The walker itself appears to be a straightforward enough design, and if the typical Arduino-style walkers we’ve seen are anything to go by we can imagine there is significant room for gait improvement.

The non-Chinese part of the Hackaday community is frequently fascinated by the work emerging from that country. But we know there is a ton of interesting things going on in the engineering communities there that the rest of the world often doesn’t have the chance to enjoy. What began as a few lone voices giving us a peek at their world is beginning to expand to a flow of interesting work share by the Chinese hardware hacking community to the excitement of non-Chinese-speaking hardware geeks everywhere. We hope that this competition helps to continue that trend, and if the high quality of these projects is anything to go by, we look forward to the Hackaday Prize China returning in future. Congratulations to these finalists, and all who entered!

Tags: contests
10:00
How to Build the Strongest Arches
» ‎ Hack a Day

When it comes to architectural features, there are probably not many as quintessentially memorable as arches. From the simplicity of the curved structure to the seemingly impossible task of a supposedly collapsable shape supporting so much weight in mid-air, they’ve naturally fascinated architects for generations.

For civil engineers, learning to calculate the forces acting on an arch, the material strength and properties, and the weight distribution across several arches may be familiar, but for anyone with only a basic physics and CAD background, it’s easy to take arches for granted. After all, they grace the Roman aqueducts, the Great Wall of China, and are even present in nature at Arches National Park. We see them in cathedrals, mosques, gateways, and even memorialized in the case of the St. Louis Gateway Arch. Even the circular construction of watch towers and wells, as well as our own rib cages, are due to the properties of arches.

But what really goes into constructing a strong arch?
Basic Concepts
Arches share many key concepts with chains. For one, the weight of the arch does not contribute to its shape, but the distance between its ends does. Every shape formed within an arch of a certain length (measured by its circumference) is known as a catenary, with similarities to parabola.

[University of Waterloo]While not all arches are built from bricks, all arches do exhibit tension between points of contact of their construction material, forming a compression system of connectors pushing against each other. This works to a builder’s advantage, as the friction between materials coupled with this tension allows the materials to stay in place.

While arches do end up being durable and long-lasting structures, when they are not shaped appropriately for the loads they are meant to carry, they can collapse. Given the similarities between arches and chains, the angles needed to carry loads in the chain (a tension system) can be mirrored in the angles needed for an arch to carry the same loads.
Image source: [KK Clark]
The Basilica of the Sagrada Familia in Barcelona uses the same techniques for its magnificent arches. Architect Antoni Gaudí initially built an upside-down model of the basilica, adding weights proportional to the roofs and other features he intended on adding to the structure. The resulting profile was the exact shape necessary for his arches to support the weight of the rest of the basilica.

For bridges, since there are not heavy static forces, so long as the arch has sufficient weight of its own, it does not need to take into account the position of its loads. This is due to the fact that similar to adding weights to a heavy or light chain, the heavier the arch, the less it transforms from the application of loads.
Modifying Arches
One interesting quandary for most people is figuring out which arches are able to support their own weight. University of Waterloo professor Wayne Brodland explains in his course on engineering models that as long as an arch is a mirror image of a chain of the same length hung from the same end points, then its shape is valid and can stand under its own weight.

This accounts for heavier semicircular arches, lighter arches with wider endpoints, and taller arches with closer endpoints and is known as the chain test. The test requires that a chain be able to fit within the arch when it is mirrored upside down. This also explains why thicker arches are able to adopt shapes that thinner arches cannot.

Another option is to adapt the shape of the chain to the shape of the arch. Since this requires outward forcing pulling on the chain, reversing these forces to push inwards on the arch allows it to hold up its shape.

[via University of Waterloo]The forces applied to the ends of an arch are vector forces: pushing not just down, but also out. These two forces are balanced out by the normal force perpendicular to the surface and the frictional force parallel to the surface. If the forces produced by the arch are greater than the forces balancing the arch, particularly if the horizontal force is greater than the friction force needed to keep the endpoints in place, then the arch can collapse. For this reason, increasing surface friction can help an arch stay in place. In construction projects, end supports for arches are often angled to better transfer the forces to the arch’s endpoints.
Arch Supports
Rather than simply modifying the end points, however, the horizontal forces can also be provided by the stuff that surrounds the arch. Often, this takes the form of bricks and concrete around bridge.

[via University of Waterloo]For multiple arches in a row, the horizontal forces at their ends can be made to balance, with each arch providing the necessary balancing forces for adjacent arches. The allows them to be supported by thinner columns.

In the case of the Hoover Dam, the shape of the structure holding back the water in the dam is shaped as an arch on its side, with the load against the top of the arch. In this example, it’s clear that the shape of the arch can be mirrored in the shape of a chain.

[via University of Waterloo]Not all arches are structural, however, and often times bridges will use arches simply as decorative features. Nonetheless, it’s clear that there’s a more to know about arches than we knew initially – maybe you’ll incorporate some of these concepts into your next build project!

[Thanks to Chris Lam for the tip!]

Tags: hackaday Columns

8:55
Hacking The PS2 With Yabasic
» ‎ Packet Storm Security Recent Files

Whitepaper that discusses hacking the Sony Playstation 2 with Yabasic.
Tags:

8:55
Hacking The PS2 With Yabasic
» ‎ Packet Storm Security Misc. Files

Whitepaper that discusses hacking the Sony Playstation 2 with Yabasic.
Tags:

8:30
A DIY Bench-Sized Milling Machine
» ‎ Hack a Day

Hanging around the machining community online, you’d be more than familiar with clapped out Bridgeport mills, which are practically a meme at this point. But mills come in all shapes and sizes, from the stout old iron from the days of yore, to smaller, compact builds. [Honus] decided to build the latter, and shared the details of the project.

The aim of [Honus’s] build is to create a small benchtop mill, capable of handling the smaller tasks. The frame of the mill is built out of 80/20 extrusion, with plenty of aluminium plate to go along with it. Igus linear slides handle the X, Y and Z axes. An old brushed Makita drill motor serves as the spindle drive, controlled by an old R/C speed controller hooked up to an Arduino. [Honus] then fabbed up various bits and pieces as neccessary to bring it all together.

The mill is neat and tidy, and looks to do a good job machining aluminium. We imagine it should prove highly useful in [Honus’s] workshop. If you’re contemplating getting yourself some desk-sized tools, perhaps consider an engraver as well! Video after the break.

Tags: tool hacks
7:01
The Final Days of the Fire Lookouts
» ‎ Hack a Day

For more than a century, the United States Forest Service has employed men and women to monitor vast swaths of wilderness from isolated lookout towers. Armed with little more than a pair of binoculars and a map, these lookouts served as an early warning system for combating wildfires. Eventually the towers would be equipped with radios, and later still a cellular or satellite connection to the Internet, but beyond that the job of fire lookout has changed little since the 1900s.

Like the lighthouse keepers of old, there’s a certain romance surrounding the fire lookouts. Sitting alone in their tower, the majority of their time is spent looking at a horizon they’ve memorized over years or even decades, carefully watching for the slightest whiff of smoke. The isolation has been a prison for some, and a paradise for others. Author Jack Kerouac spent the summer of 1956 in a lookout tower on Desolation Peak in Washington state, an experience which he wrote about in several works including Desolation Angels.

But slowly, in a change completely imperceptible to the public, the era of the fire lookouts has been drawing to a close. As technology improves, the idea of perching a human on top of a tall tower for months on end seems increasingly archaic. Many are staunchly opposed to the idea of automation replacing human workers, but in the case of the fire lookouts, it’s difficult to argue against it. Computer vision offers an unwavering eye that can detect even the smallest column of smoke amongst acres of woodland, while drones equipped with GPS can pinpoint its location and make on-site assessments without risk to human life.

At one point, the United States Forest Service operated more than 5,000 permanent fire lookout towers, but today that number has dwindled into the hundreds. As this niche job fades even farther into obscurity, let’s take a look at the fire lookout’s most famous tool, and the modern technology poised to replace it.

The Osborne Firefinder
At the most basic level, the job of the fire lookout is to detect and locate the first signs of a possible fire. This boils down to carefully scanning the horizon for signs of smoke, and if seen, plotting the position of the plume on a map and communicating its location to the on-duty fire crews. All a fire lookout actually needs to accomplish this task is a map of the area he or she is monitoring, and ideally a pair of binoculars or a small telescope. Indeed, prior to the 20th century, this would have been the extent of the equipment available.

But in 1911, William Bushnell Osborne invented the tool which would ultimately become the hallmark of the fire lookout: the Osborne Firefinder. The device, a type of alidade, featured a large circular map of the surrounding area and a sighting apparatus that rotated above it. Some variations of the Firefinder used what was effectively a rifle scope, but others used a “peep” sight that was nothing more than a strip of metal with a small hole drilled into it. In either case, the operator would rotate the Firefinder until they could see the base of the smoke column through the sights.

The center of the circular map represented the location of the tower, with compass headings marked around the entire circumference. When the smoke was sighted in, the degrees of rotation marked by the Firefinder would correspond to the azimuth of the target. This heading could be forwarded to other nearby towers and, assuming they could see the smoke from their vantage point, allowed for triangulation of the fire’s location.

If there were no other towers in the area, or they were unable to see the smoke from their position, the operator of the Firefinder could employ the elevation measurement marks on the sights to estimate distance. With the compass heading and an idea of how distant the smoke was from the base of the tower, crews on the ground would at least have enough information to start their search.

Back to the Future
The Osborne Firefinder was a simple device with few moving parts, and yet when properly set up and calibrated, allowed fire lookouts to locate potential danger with unparalleled accuracy for the era. Realistically, the United States Forest Service didn’t have a better way of pinpointing the location of a fire until the use of aircraft became practical. But even still, the Firefinder was a compelling option as it was cheap and easy to use.

Moreover, the Firefinder went through its own evolution over the years, with new variations steadily increasing its accuracy and utility. These incremental updates culminated with the 1934 version, of which more than 3,000 were manufactured and distributed to lookout towers both domestically and abroad. Incredibly, this version was still being manufactured in the United States up until 1989.
The prototype SDTDC Firefinder
But by the 2000s, there was a problem. With original Osborne Firefinders still in use all over the country, and the supply of spare parts dwindling, the Forest Service’s San Dimas Technology and Development Center (SDTDC) decided to investigate replicating the vintage devices. The various models of the Firefinder were compared, disassembled, and modeled in AutoCAD. Some slight modifications were made based on input from veteran fire lookouts, and prototypes of the new and improved 2003 model Firefinder were built and tested at the Odell Butte and Green Mountain lookout towers in Oregon.

After the successful test program, Palmquist Tooling in California began manufacturing new Firefinders and replacement parts that were largely backwards compatible with the original models. Upgrades for the modern Firefinders included replacing cast iron components with aluminum to save weight, and the addition of nylon bearings to reduce wear.
Eyes in the Sky
Firefinders, whether original Osborne or the updated SDTDC versions, are still actively being used today. Given the fixed location of the tower as a reference point, they give lookouts a simple and reliable way to determine with reasonable accuracy the coordinates of a potential fire. But the reality is that automated systems can do the same job faster and with a much higher degree of accuracy than any human.

Currently, there are a number of different high-tech approaches being used or considered for fire detection. A new space-based system was just brought online over the summer that uses data from several orbiting spacecraft, including the latest GOES weather satellites, to provide continuous monitoring of potential or ongoing wildfires. With updates being pushed out as quickly as once per minute, the system gives emergency agencies a high-level view of the situation in nearly real-time, allowing for efforts to be coordinated far more efficiently than was possible in the past.

But there’s only so much that can be seen from space. To provide a closer view of conditions on the ground without endangering human life, several small Unmanned Aerial Vehicles (UAVs) have been approved for use in and around active wildfires for the purposes of on-site monitoring. These craft can get far closer to the fire than manned vehicles or firefighters can, and provide crucial information on how best to combat it. Similar UAVs proved invaluable during the blaze at Notre Dame cathedral, and represent something of a revolution in close-quarters firefighting technology.
The Silent Falcon, a solar electric UAV used for wildfire monitoring Freaks on the Peaks
It’s undeniable that technology has largely supplanted the fire lookouts at this point. The US Forest Service actually rents out many of the towers as summer vacation cabins now, as the task they were built for has been antiquated by satellites and UAVs. But in the parts of the country where the towers are still staffed with self-identified “Freaks on the Peaks”, the old ways are alive and well.

Even with all the modern technology available, human lookouts can still be a viable option. For one, they’re cheap: most fire lookouts are employed only during the summer months and paid an average of $12 USD per hour. Some of the lookouts have been stationed at the same tower for decades, which gives them invaluable experience with the nuances of the land that can be critical in a crisis. Operating conditions also need to be taken into consideration: UAVs have a difficult time flying in the summer thunderstorms which have been known to trigger wildfires.

With time, even these advantages are likely to be overcome by newer and more advanced automated systems. But until then, a small army of men and women will still climb their towers every spring and keep vigil over the forest with little to keep them company beyond an Osborne Firefinder that was likely built decades before they were born.

Tags: current Events

6:53
Debian Security Advisory 4543-1
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 4543-1 - Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID - -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.
Tags:

6:53
Debian Security Advisory 4543-1
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 4543-1 - Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID - -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.
Tags:

6:53
Debian Security Advisory 4543-1
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 4543-1 - Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID - -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.
Tags:

6:53
Slackware Security Advisory - sudo Updates
» ‎ Packet Storm Security Advisories

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
Tags:

6:53
Slackware Security Advisory - sudo Updates
» ‎ Packet Storm Security Recent Files

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
Tags:

6:53
Slackware Security Advisory - sudo Updates
» ‎ Packet Storm Security Misc. Files

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
Tags:

6:49
1 In 5 IT Security Professionals Fear Their Toilets Will Be Hacked
» ‎ Packet Storm Security Headlines

1 In 5 IT Security Professionals Fear Their Toilets Will Be Hacked
Tags: headlinehackerprivacy
6:49
Security Researcher Arrested After Tweeting About Gov't Hack
» ‎ Packet Storm Security Headlines

Security Researcher Arrested After Tweeting About Gov't Hack
Tags: headlinehackergovernmentdata lossargentina
6:49
Malware That Spits Cash Out Of ATMs Has Spread Across The World
» ‎ Packet Storm Security Headlines

Malware That Spits Cash Out Of ATMs Has Spread Across The World
Tags: headlinemalwarebankcybercrimefraud
6:49
Without Encryption We Will Lose All Privacy. This Is Our New Battleground.
» ‎ Packet Storm Security Headlines

Without Encryption We Will Lose All Privacy. This Is Our New Battleground.
Tags: headlinegovernmentprivacyusaspywarensacryptography

4:00
Hacking Pixmob Bands And Finding A Toolchain
» ‎ Hack a Day

The Pixmob band is an LED wrist strap, of the type often used at big concerts or other public events. Many have tinkered with the device, but as of yet, nobody was running custom code. It wouldn’t be easy, but [JinGen Lim] got down to work.
The wristbands are given out to concertgoers to create synchronized light shows in the crowd.
A teardown of a 2016 device revealed it consisted of an RGB LED, an IR sensor, a small EEPROM and a coin cell, which were all common parts. Unfortunately, the ABOV MC81F4204 microcontroller was a little more obscure. It’s a part that’s quite hard to find, and uses a proprietary programmer and an ancient IDE.

Searches online proved fruitless, and a working programmer remained outside [JinGen]’s grasp. Undeterred, he decided to simply walk into the company’s Korean headquarters and ask for help. As the part was end-of-life, they were unable to supply a programming device, but happily provided documentation for the chip that wasn’t publicly available. With this in hand, it was possible for [JinGen] to build his own programmer instead.

Booting up a copy of the ABOV IDE, with his newly-built programmer in hand, it was relatively easy to get the chip running custom code. Going the extra mile, [JinGen] even hacked the Arduino IDE to be partially compatible with the platform! A silicon error in the MC81F4204 design bricks the chips after only a few flash rewrites, so its never going to be the most useful platform, but it works nonetheless.

The Pixmob hardware has continued to evolve, and it’s unlikely modern units still use the same chip. Despite this, it’s a great example of what can be achieved by a little sleuthing and asking the right people the right questions. Others have attempted to hack similar products before, found at Disneyland and Coldplay concerts. You won’t catch this author at either, but if you’ve hacked something similar, be sure to reach out on the tip line!

Tags: misc hacks
1:00
[Ben Krasnow] Looks Inside Film Camera Date Stamping
» ‎ Hack a Day

Honestly, we never wondered how those old film cameras used to put the date stamp in the lower right-hand corner of the frame. Luckily, [Ben Krasnow] does not suffer from this deplorable lack of curiosity, and his video teardown of a date-stamping film camera back (embedded below) not only answers the question, but provides a useful lesson in value engineering.

For the likely fair fraction of the audience who has never taken a photo on film before, cheap 35-mm cameras were once a big thing. They were really all one had for family snapshots and the like unless you wanted to invest in single-lens reflex cameras and all the lenses and accessories. They were miles better than earlier cartridge cameras like the 110 or – shudder – Disc film, and the cameras started getting some neat electronic features too. One was the little red-orange date stamp, which from the color we – and [Ben] assumed was some sort of LED pressed up against the film, but it ends up being much cooler than that.

Digging into the back of an old camera, [Ben] found that there’s actually a tiny projector that uses a mirror to fold the optical path between the film and a grain-of-wheat incandescent bulb. An LCD filter sits in the optical path, but because it’s not exactly on the plane of the film, it actually has to project the image onto the film. The incandescent bulb acts as a point source and the mirror makes the optical path long enough that the date stamp image appears sharp on the film. It’s cheap, readily adapted to other cameras, and reliable.

Teardowns like this aren’t fodder for [Ben]’s usual video fare, which tends more toward homemade CT scanners and Apollo-grade electroluminescent displays, but this was informative and interesting, too.

Thanks for the tip, [Jan].

Tags: digital cameras hacks

0:27
[SECURITY] [DSA 4543-1] sudo security update
» ‎ Bugtraq

Posted by Salvatore Bonaccorso on Oct 15
-------------------------------------------------------------------------
Debian Security Advisory DSA-4543-1 security () debian org
https://www.debian.org/security/ Salvatore Bonaccorso
October 14, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : sudo
CVE ID : CVE-2019-14287
Debian Bug :...

Tags:
0:23
[slackware-security] sudo (SSA:2019-287-01)
» ‎ Bugtraq

Posted by Slackware Security Team on Oct 15
[slackware-security] sudo (SSA:2019-287-01)

New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to
fix a security issue.

Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/sudo-1.8.28-i586-1_slack14.2.txz: Upgraded.
Fixed a bug where an sudo user may be able to run a command as root when
the Runas specification explicitly disallows root access as long as the
ALL...

Tags:

October 14, 2019
22:00
Repurposing A Toy Computer From The 1990s
» ‎ Hack a Day

Our more youthful readers are fairly likely to have owned some incarnation of a VTech educational computer. From the mid-1980s and right up to the present day, VTech has been producing vaguely laptop shaped gadgets aimed at teaching everything from basic reading skills all the way up to world history. Hallmarks of these devices include a miserable monochrome LCD, and unpleasant membrane keyboard, and as [HotKey] found, occasionally a proper Z80 processor.

It started, as such things often do, with eBay. [HotKey] found that the second hand market is flooded with these decades-old educational gadgets, often selling for just a few bucks. As it turns out, children of the smartphone and tablet era don’t seem terribly interested in a “laptop” from 1991. At any rate, he ordered about a dozen different models and started tearing into them to see what made them tick.

He found that the VTech machines of around 20+ years old were using the Z80 processor, and what’s more, they shared a fairly standardized external cartridge interface for adding additional software or saving data. Upon attempting to dump some data from the cartridge port, [HotKey] discovered that it was actually connected to the computer’s main bus. He realized that with a custom designed cartridge, it should be able to take over the system and have it run his own code.

After more than a year of tinkering and talking to other hackers in the Z80 scene, [HotKey] has made some impressive headway. He’s not only created a custom cartridge that lets him load new code and connect to external devices, but he’s also added support for a few VTech machines to z88dk so that others can start writing their own C code for these machines. So far he’s created some very promising proof of concept programs such as a MIDI controller and serial terminal, but ultimately he hopes to create a DOS or CP/M like operating system that will elevate these vintage machines from simple toys to legitimate multi-purpose computers.

We’ve seen VTech hardware hacked in the past, but it’s generally been focused on the company’s more recent hardware such as the Linux-powered InnoTab. It will be interesting to see if these educational toys can fulfill some hacker’s dreams of having a cheap and portable box for Z80 tinkering.

Tags: Retrocomputing
19:00
Coffee Makes 3D Printing Better
» ‎ Hack a Day

While we know some 3D printer operators who need coffee, Washington State University is showing an improved PLA material that incorporates used coffee waste. Regular PLA is not known for being especially strong, though It isn’t uncommon for vendors to add things to their PLA to change its characteristics.

The new material containing about 20% coffee waste showed an over 400% increase in toughness (25.24 MJ/m³) versus standard PLA. Why coffee waste? We aren’t sure. They didn’t add grounds, but rather a dry and odorless material left over after coffee grounds are processed for biodiesel production.

The coffee waste has quite a bit of cellulose in it, which presumably accounts for the additional strength. The actual paper describes how PLA powder and commercially available spent coffee grounds — we don’t know what people usually use them for — formed filament using a Filabot.

Apparently this material is pretty cheap. After all, it is a waste product that occurs after you reuse another waste product. There’s plenty of it, too, since apparently Earthlings drink about 2 billion cups of coffee a day.

There seems to be this odd connection between filament and kitchen items. Seriously.

Tags: printer hacks

17:15
Podman / Varlink Remote Code Execution
» ‎ Packet Storm Security Exploits

Remote exploit for Podman when configured with Varlink that allows for remote command execution, denial of service, directory traversal, and information disclosure vulnerabilities.
Tags:

17:15
Podman / Varlink Remote Code Execution
» ‎ Packet Storm Security Recent Files

Remote exploit for Podman when configured with Varlink that allows for remote command execution, denial of service, directory traversal, and information disclosure vulnerabilities.
Tags:

17:15
Podman / Varlink Remote Code Execution
» ‎ Packet Storm Security Misc. Files

Remote exploit for Podman when configured with Varlink that allows for remote command execution, denial of service, directory traversal, and information disclosure vulnerabilities.
Tags:

17:12
OpenProject 10.0.1 / 9.0.3 Cross Site Scripting
» ‎ Packet Storm Security Exploits

OpenProject versions 9.0.3 and below and 10.0.1 and below suffer from multiple cross site scripting vulnerabilities.
Tags:

17:12
OpenProject 10.0.1 / 9.0.3 Cross Site Scripting
» ‎ Packet Storm Security Recent Files

OpenProject versions 9.0.3 and below and 10.0.1 and below suffer from multiple cross site scripting vulnerabilities.
Tags:

17:12
OpenProject 10.0.1 / 9.0.3 Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

OpenProject versions 9.0.3 and below and 10.0.1 and below suffer from multiple cross site scripting vulnerabilities.
Tags:

17:11
Red Hat Security Advisory 2019-3050-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3050-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 serves as a replacement for Red Hat Single Sign-On 7.2.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

17:11
Red Hat Security Advisory 2019-3050-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3050-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 serves as a replacement for Red Hat Single Sign-On 7.2.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

17:11
Red Hat Security Advisory 2019-3050-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3050-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 serves as a replacement for Red Hat Single Sign-On 7.2.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

17:10
Red Hat Security Advisory 2019-3049-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3049-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 7.2. An adapter endpoint exposure issue has been addressed.
Tags:

17:10
Red Hat Security Advisory 2019-3049-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3049-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 7.2. An adapter endpoint exposure issue has been addressed.
Tags:

17:10
Red Hat Security Advisory 2019-3049-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3049-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 7.2. An adapter endpoint exposure issue has been addressed.
Tags:

17:10
Red Hat Security Advisory 2019-3041-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3041-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers the RPM packages for the OpenShift Service Mesh 1.0.1 release. Issues addressed include a denial of service vulnerability.
Tags:

17:10
Red Hat Security Advisory 2019-3041-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3041-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers the RPM packages for the OpenShift Service Mesh 1.0.1 release. Issues addressed include a denial of service vulnerability.
Tags:

17:10
Red Hat Security Advisory 2019-3041-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3041-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers the RPM packages for the OpenShift Service Mesh 1.0.1 release. Issues addressed include a denial of service vulnerability.
Tags:

17:10
Ubuntu Security Notice USN-4154-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 4154-1 - Joe Vennix discovered that Sudo incorrectly handled certain user IDs. An attacker could potentially exploit this to execute arbitrary commands as the root user.
Tags:

17:10
Ubuntu Security Notice USN-4154-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 4154-1 - Joe Vennix discovered that Sudo incorrectly handled certain user IDs. An attacker could potentially exploit this to execute arbitrary commands as the root user.
Tags:

17:10
Ubuntu Security Notice USN-4154-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 4154-1 - Joe Vennix discovered that Sudo incorrectly handled certain user IDs. An attacker could potentially exploit this to execute arbitrary commands as the root user.
Tags:

16:33
Red Hat Security Advisory 2019-3048-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3048-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 6. An adapter endpoints exposure issue was addressed.
Tags:

16:33
Red Hat Security Advisory 2019-3048-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3048-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 6. An adapter endpoints exposure issue was addressed.
Tags:

16:33
Red Hat Security Advisory 2019-3048-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3048-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 6. An adapter endpoints exposure issue was addressed.
Tags:

16:03
Red Hat Security Advisory 2019-3046-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3046-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

16:03
Red Hat Security Advisory 2019-3046-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3046-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

16:03
Red Hat Security Advisory 2019-3046-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3046-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

16:00
What Better Than A Hexapod?
» ‎ Hack a Day

What’s more awesome than a normal hexapod robot? What about a MEGA hexapod?

Max the Megapod, a six-legged 3D-printed walking robot, is an open source, Arduino-based, Bluetooth controlled, Scratch programmable creation made possible by [Steven Pendergrast]. The design for Max was based on a previous hexapod project, Vorpal the Hexapod, which has since been built at hundreds of schools worldwide.

Max clocks in at two feet in diameter, expanding to three when sprawled out on the ground. In addition, the hexapod is able to dance, walk, and run as fast as the smaller version, covering ground at twice the speed due to its size.

The scaling for the project – about 200% from the original hexapod – required some creativity, as the goal was for the components to be printed on a modest-sized printer with an 8 inch cube bed. In addition, since Max weighs 9 pounds on average, real bearings (608 Skate bearings) needed to be used for the servo mounts.

The electrical system had to be changed to account for the larger currents drawn by the larger servos (MG958s). and the power distribution harness needed to be redesigned. The current harness take about two hours to build for the larger hexapod, compared to 15 minutes for the original design.

The results are both hilarious and adorable, especially given the endless modifications made to give Max a unique flair. Perhaps a GIGApod could be coming up next?

Tags: printer hacks

13:33
Red Hat Security Advisory 2019-3045-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3045-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

13:33
Red Hat Security Advisory 2019-3045-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3045-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

13:33
Red Hat Security Advisory 2019-3045-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3045-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

13:22
Red Hat Security Advisory 2019-3044-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3044-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 6 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

13:22
Red Hat Security Advisory 2019-3044-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3044-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 6 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

13:22
Red Hat Security Advisory 2019-3044-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3044-01 - Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.4 on RHEL 6 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include bypass and code execution vulnerabilities.
Tags:

13:00
This Dry-Ice Powered Fog Machine Is Perfect For Halloween
» ‎ Hack a Day

The leaves are turning brown, and the spookier season is upon us. If you’re currently working up plans for a top-notch Halloween party, you would do well to consider building a fog machine like this unit from [DIY Machines]!

This fog machine is based around dry ice, so you’ll need to source that from an external supplier. The machine consists of a closed container filled with hot water, inside which is a movable bucket filled with dry ice. By lowering the dry ice into the water, fog is produced.

An Arduino is used to control the bucket, allowing the amount of fog produced to be controlled with a smartphone app. There are also controllable LEDs built in to give the fog a suitably eerie glow. The build relies on a series of 3D printed parts for the mechanism, and features several different nozzle designs for achieving different effects, such as a rising geyser or a thick low-lying fog.

The basic concepts are simple and it’s a build anyone could knock out in a weekend with a 3D printer and an Amazon account. It’s a great way to add to the ambience of Halloween, but of course, that’s not all fog can do. Video after the break.

Tags: holiday hacks
11:30
A (Mostly) 3D Printed Servo/Gear Reduction
» ‎ Hack a Day

This servo/gear reduction was assembled with almost all 3D-printed parts. Apart from a brushed 36 V DC-motor, a stainless steel shaft, and screws for holding the servo together, the only other non-printed part is the BTS7960B motor driver.

Some interesting stats about the plastic servo – its stall torque is about 55 kg/cm, reaching a peak current draw of 18 A when using a 6s LiPo battery outputting 22-24 V. The shaft rotates using two 20 mm holes and lubrication. (Ball bearings were originally in the design, but they didn’t arrive on time for the assembly.)

The holes of the gears are 6.2 mm in diameter in order to fit around the shaft, although some care is taken to sand or fill the opening depending on the quality of the 3D print.

This isn’t [Brian Brocken]’s only attempt at 3D-printing gears. He’s also built several crawling robots, a turntable, and a wind up car made entirely from acrylic. The .stl files for the project are all available online for anyone looking to make their own 3D-printed servo gears.

The HackadayPrize2019 is Sponsored by:

Tags: printer hacks
10:01
Linux Fu: Python GUIs for Command Line Programs (Almost) Instantly
» ‎ Hack a Day
Not every programmer likes creating GUI code. Most hacker types don’t mind a command line interface, but very few ordinary users appreciate them. However, if you write command line programs in Python, Gooey can help. By leveraging some Python features and a common Python idiom, you can convert a command line program into a GUI with very little effort.

The idea is pretty simple. Nearly all command line Python programs use argparse to simplify picking options and arguments off the command line as well as providing some help. The Gooey decorator picks up all your options and arguments and creates a GUI for it. You can make it more complicated if you want to change specific things, but if you are happy with the defaults, there’s not much else to it.

At first, this article might seem like a Python Fu and not a Linux Fu, since — at first — we are going to focus on Python. But just stand by and you’ll see how this can do a lot of things on many operating systems, including Linux.

Hands On
We had to try it. Here’s the code from the argparse manual page, extended to live inside a main function:
```
import argparse

def main():

   parser = argparse.ArgumentParser(description='Process some integers.')
   parser.add_argument('integers', metavar='N', type=int, nargs='+',
         help='an integer for the accumulator')
   parser.add_argument('--sum', dest='accumulate', action='store_const',
        const=sum, default=max,
   help='sum the integers (default: find the max)')

   args = parser.parse_args()
   print(args.accumulate(args.integers))

main()
```
You can run this at the command line (we called it iprocess.py):
```
python iprocess.py 4 33 2
python iprocess.py --sum 10 20 30
```
In the first case, the program will select and print the largest number. In the second case, it will add all the arguments together.

Creating a GUI took exactly two steps (apart from installing Gooey): First, you import Gooey at the top of the file:
```
from gooey import Gooey
```
Then add the decorator @Gooey on the line before the main definition (and, yes, it really needs to be on the line before, not on the same line):
```
@Gooey
def main():
```
The result looks like this:

You might want to tweak the results and you can also add validation pretty easily so some fields are required or have to contain particular types of data.
Sure That Works on Linux, But…
Python, of course, runs on many different platforms. So why is this part of Linux Fu? Because you can easily use it to launch any command line program. True, that also should work on other operating systems, but it is especially useful on Linux where there are so many command line programs.

We first saw this done on Chris Kiehl’s blog where he does a GUI — or Gooey, I suppose — for ffmpeg which has a lot of command line options. The idea is to write a simple argparse set up for the program and then tell GUI what executable to actually launch after assembling the command line.

Here’s Chris’ code:
```
from gooey import Gooey, GooeyParser

@Gooey(target="ffmpeg", program_name='Frame Extraction v1.0', suppress_gooey_flag=True)
def main():
   parser = GooeyParser(description="Extracting frames from a movie using FFMPEG")
   ffmpeg = parser.add_argument_group('Frame Extraction Util')
      ffmpeg.add_argument('-i',
      metavar='Input Movie',
      help='The movie for which you want to extract frames',
      widget='FileChooser')
   ffmpeg.add_argument('output',
      metavar='Output Image',
      help='Where to save the extracted frame',
      widget='FileSaver')
   ffmpeg.add_argument('-ss',
      metavar='Timestamp',
      help='Timestamp of snapshot (in seconds)')
   ffmpeg.add_argument('-frames:v',
      metavar='Timestamp',
      default=1,
      gooey_options={'visible': False})

parser.parse_args()

if __name__ == '__main__':
   main()
```
You even have the option of creating a JSON file that Gooey can read if you don’t want to write Python. The utility of this is easy to see, but I’d love to hear some concrete examples of where you think it will come in handy. If you’re already using Gooey, or plan to give it a shot after reading this article, let us know in the comments below.

Of course, not all Python GUIs are created equal. Neither are all Python graphics.

Tags: linux hacks

9:10
SEC Consult SA-20191014-0 :: Reflected XSS vulnerability in OpenProject
» ‎ Bugtraq

Posted by SEC Consult Vulnerability Lab on Oct 14
SEC Consult Vulnerability Lab Security Advisory < 20191014-0 >
=======================================================================
title: Reflected XSS vulnerability
product: OpenProject
vulnerable version: <= 9.0.3, <=10.0.1
fixed version: 9.0.4, 10.0.2
CVE number: CVE-2019-17092
impact: medium
homepage: https://www.openproject.org
found: 2019-09-27...

Tags:

9:00
Hacking Diabetes Hack Chat
» ‎ Hack a Day

Join us on Wednesday, October 16 at noon Pacific for the Hacking Diabetes Hack Chat with Dana Lewis!

When your child is newly diagnosed with Type 1 diabetes (T1D), everyone is quick to point out, “It’s a great time to be a diabetic.” To some degree, that’s true; thanks to genetically engineered insulin, more frequent or even continuous glucose monitoring (CGM), and insulin infusion pumps, diabetics can now avoid many of the truly terrifying complications of a life lived with chronically elevated blood glucose, like heart disease, kidney failure, blindness, and amputations.

Despite these advances, managing T1D can be an overwhelming task. Every bite of food, every minute of exercise, and every metabolic challenge has to be factored into the calculations for how much insulin to take. Diabetics learn to “think like a pancreas,” but it’s never good enough, and the long-promised day of a true artificial pancreas always seems to remain five years in the future.

Dana Lewis is one diabetic who decided not to wait. After realizing that she could get data from her CGM, she built a system to allow friends and family to monitor her blood glucose readings remotely. With the addition of a Raspberry Pi and some predictive algorithms, she later built an open-source artificial pancreas, which she uses every day. And now she’s helping others take control of their diabetes and build their own devices through OpenAPS.org.

Join us on the Hack Chat as Dana drops by to discuss OpenAPS and her artificial pancreas. We’ll find out what her background is – spoiler alert: she wasn’t a hacker when she started this – what challenges she faced, the state of the OpenAPS project, and where she sees the artificial pancreas going.

Our Hack Chats are live community events in the Hackaday.io Hack Chat group messaging. This week we’ll be sitting down on Wednesday, October 16 at 12:00 PM Pacific time. If time zones have got you down, we have a handy time zone converter.

Click that speech bubble to the right, and you’ll be taken directly to the Hack Chat group on Hackaday.io. You don’t have to wait until Wednesday; join whenever you want and you can see what the community is talking about.

[Dana Lewis image source: GeekWire]

Tags: hackaday Columns
8:30
The MorningRod Wants Your Mornings Easier, Not Harder
» ‎ Hack a Day

Curtains are about as simple as household devices get, but they can be remarkably troublesome to automate. Everyone’s window treatments slightly different, which frustrates a standardized solution. [dfrenkel] has a passion for DIY and wanted his mornings flooded with sunlight for more peaceful awakenings, so the MorningRod Smart Curtain Rod was born.
Replacing the curtain rod with aluminum extrusion and 3D printed fixtures goes a long way towards standardizing for automation.
MorningRod’s design takes advantage of affordable hardware like aluminum extrusions and 3D printed parts to create a system that attempts to allow users to keep their existing curtains as much as possible.

The curtain rod is replaced with aluminum extrusion. MorningRod borrows ideas from CNC projects to turn the curtain rod into a kind of double-ended linear actuator, upon which the curtains are just along for the ride. An ESP32 serves as the brains while a NEMA17 stepper motor provides the brawn. The result is a motorized curtain opening and closing with a wireless interface that can be easily integrated into home automation projects.

[dfrenkel] is offering a kit, but those who would prefer to roll their own should check out the project page on Thingiverse.

Tags: home hacks

8:16
Botan C++ Crypto Algorithms Library 2.12.1
» ‎ Packet Storm Security Recent Files

Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS #10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to most systems and compilers, and includes a substantial tutorial and API reference. This is the current stable release.
Tags:

8:16
Botan C++ Crypto Algorithms Library 2.12.1
» ‎ Packet Storm Security Misc. Files

Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS #10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to most systems and compilers, and includes a substantial tutorial and API reference. This is the current stable release.
Tags:

8:11
Red Hat Security Advisory 2019-2989-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-2989-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. TLS verification and SSH host key verification issues were addressed.
Tags:

8:11
Red Hat Security Advisory 2019-2989-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-2989-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. TLS verification and SSH host key verification issues were addressed.
Tags:

8:11
Red Hat Security Advisory 2019-2989-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-2989-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. TLS verification and SSH host key verification issues were addressed.
Tags:

8:10
ASUS RT-N10+ 2.0.3.4 CSRF / XSS / Command Execution
» ‎ Packet Storm Security Exploits

ASUS RT-N10+ with firmware version 2.0.3.4 suffers from cross site request forgery and cross site scripting vulnerabilities that can assist with achieving command execution.
Tags:

8:10
ASUS RT-N10+ 2.0.3.4 CSRF / XSS / Command Execution
» ‎ Packet Storm Security Recent Files

ASUS RT-N10+ with firmware version 2.0.3.4 suffers from cross site request forgery and cross site scripting vulnerabilities that can assist with achieving command execution.
Tags:

8:10
ASUS RT-N10+ 2.0.3.4 CSRF / XSS / Command Execution
» ‎ Packet Storm Security Misc. Files

ASUS RT-N10+ with firmware version 2.0.3.4 suffers from cross site request forgery and cross site scripting vulnerabilities that can assist with achieving command execution.
Tags:

8:08
Apple Security Advisory 2019-10-11-1
» ‎ Packet Storm Security Advisories

Apple Security Advisory 2019-10-11-1 - Swift 5.1.1 for Ubuntu is now available and addresses an issue with data disclosure.
Tags:

8:08
Apple Security Advisory 2019-10-11-1
» ‎ Packet Storm Security Recent Files

Apple Security Advisory 2019-10-11-1 - Swift 5.1.1 for Ubuntu is now available and addresses an issue with data disclosure.
Tags:

8:08
Apple Security Advisory 2019-10-11-1
» ‎ Packet Storm Security Misc. Files

Apple Security Advisory 2019-10-11-1 - Swift 5.1.1 for Ubuntu is now available and addresses an issue with data disclosure.
Tags:

8:07
Kirona-DRS 5.5.3.5 Information Disclosure
» ‎ Packet Storm Security Exploits

Kirona-DRS version 5.5.3.5 suffers from an information disclosure vulnerability.
Tags:

8:07
Kirona-DRS 5.5.3.5 Information Disclosure
» ‎ Packet Storm Security Recent Files

Kirona-DRS version 5.5.3.5 suffers from an information disclosure vulnerability.
Tags:

8:07
Kirona-DRS 5.5.3.5 Information Disclosure
» ‎ Packet Storm Security Misc. Files

Kirona-DRS version 5.5.3.5 suffers from an information disclosure vulnerability.
Tags:

7:56
Express Invoice 7.12 Cross Site Scripting
» ‎ Packet Storm Security Exploits

Express Invoice version 7.12 suffers from a persistent cross site scripting vulnerability.
Tags:

7:56
Express Invoice 7.12 Cross Site Scripting
» ‎ Packet Storm Security Recent Files

Express Invoice version 7.12 suffers from a persistent cross site scripting vulnerability.
Tags:

7:56
Express Invoice 7.12 Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

Express Invoice version 7.12 suffers from a persistent cross site scripting vulnerability.
Tags:

7:56
Debian Security Advisory 4539-3
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 4539-3 - The update for openssl released as DSA 4539-1 introduced a regression where AES-CBC-HMAC-SHA ciphers were not enabled. Updated openssl packages are now available to correct this issue.
Tags:

7:56
Debian Security Advisory 4539-3
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 4539-3 - The update for openssl released as DSA 4539-1 introduced a regression where AES-CBC-HMAC-SHA ciphers were not enabled. Updated openssl packages are now available to correct this issue.
Tags:

7:56
Debian Security Advisory 4539-3
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 4539-3 - The update for openssl released as DSA 4539-1 introduced a regression where AES-CBC-HMAC-SHA ciphers were not enabled. Updated openssl packages are now available to correct this issue.
Tags:

7:48
SEC Consult SA-20191014-0 :: Reflected XSS vulnerability in OpenProject
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Oct 14
SEC Consult Vulnerability Lab Security Advisory < 20191014-0 >
=======================================================================
title: Reflected XSS vulnerability
product: OpenProject
vulnerable version: <= 9.0.3, <=10.0.1
fixed version: 9.0.4, 10.0.2
CVE number: CVE-2019-17092
impact: medium
homepage: https://www.openproject.org
found: 2019-09-27...

Tags:

7:47
ActiveFax Server 6.92 Build 0316 Denial Of Service
» ‎ Packet Storm Security Exploits

ActiveFax Server version 6.92 build 0316 POP3 server denial of service exploit.
Tags:

7:47
ActiveFax Server 6.92 Build 0316 Denial Of Service
» ‎ Packet Storm Security Recent Files

ActiveFax Server version 6.92 build 0316 POP3 server denial of service exploit.
Tags:

7:47
ActiveFax Server 6.92 Build 0316 Denial Of Service
» ‎ Packet Storm Security Misc. Files

ActiveFax Server version 6.92 build 0316 POP3 server denial of service exploit.
Tags:

7:44
Open-Xchange OX App Suite SSRF / XSS / Information Disclosure / Access Controls
» ‎ Packet Storm Security Exploits

Various Open-Xchange OX App Suite versions suffer from server-side request forgery, cross site scripting, information disclosure, and improper access control vulnerabilities.
Tags:

7:44
Open-Xchange OX App Suite SSRF / XSS / Information Disclosure / Access Controls
» ‎ Packet Storm Security Recent Files

Various Open-Xchange OX App Suite versions suffer from server-side request forgery, cross site scripting, information disclosure, and improper access control vulnerabilities.
Tags:

7:44
Open-Xchange OX App Suite SSRF / XSS / Information Disclosure / Access Controls
» ‎ Packet Storm Security Misc. Files

Various Open-Xchange OX App Suite versions suffer from server-side request forgery, cross site scripting, information disclosure, and improper access control vulnerabilities.
Tags:

7:39
SpotAuditor 5.3.1.0 Denial Of Service
» ‎ Packet Storm Security Exploits

SpotAuditor version 5.3.1.0 suffers from a denial of service vulnerability.
Tags:

7:39
SpotAuditor 5.3.1.0 Denial Of Service
» ‎ Packet Storm Security Recent Files

SpotAuditor version 5.3.1.0 suffers from a denial of service vulnerability.
Tags:

7:39
SpotAuditor 5.3.1.0 Denial Of Service
» ‎ Packet Storm Security Misc. Files

SpotAuditor version 5.3.1.0 suffers from a denial of service vulnerability.
Tags:

7:38
Uplay 92.0.0.6280 Local Privilege Escalation
» ‎ Packet Storm Security Exploits

Uplay version 92.0.0.6280 suffers from a local privilege escalation vulnerability.
Tags:

7:38
Uplay 92.0.0.6280 Local Privilege Escalation
» ‎ Packet Storm Security Recent Files

Uplay version 92.0.0.6280 suffers from a local privilege escalation vulnerability.
Tags:

7:38
Uplay 92.0.0.6280 Local Privilege Escalation
» ‎ Packet Storm Security Misc. Files

Uplay version 92.0.0.6280 suffers from a local privilege escalation vulnerability.
Tags:

7:30
These Are The 29 Countries Vulnerable To SIM Jacker Attacks
» ‎ Packet Storm Security Headlines

These Are The 29 Countries Vulnerable To SIM Jacker Attacks
Tags: headlinehackerphonecybercrimefraudpasswordidentity theft
7:30
China's Study The Great Nation App Enables Spying Via Back Door
» ‎ Packet Storm Security Headlines

China's Study The Great Nation App Enables Spying Via Back Door
Tags: headlinegovernmentprivacyphonechinaspyware
7:29
Vulnerability Found And Fixed In HP Bloatware
» ‎ Packet Storm Security Headlines

Vulnerability Found And Fixed In HP Bloatware
Tags: headlineflawpatch
7:29
Hammond Held In Contempt For Refusing To Answer Questions
» ‎ Packet Storm Security Headlines

Hammond Held In Contempt For Refusing To Answer Questions
Tags: headlinehackergovernmentusadata lossanonymousmilitary

7:00
Military Gliders are Making a Comeback, This Time in Unmanned Form
» ‎ Hack a Day

Sun Tzu said, “The line between disorder and order lies in logistics.” This is as true in the modern world as it was 2500 years ago, and logistics have helped win and lose many wars and battles over the centuries. To this end, Logistical Gliders Inc. is developing one-time use, unmanned delivery gliders, for the US Military.

Reminiscent of the military gliders used in WW2, the gliders are designed to be dropped from a variety of aircraft, glide for up to 70 miles and deliver supplies to troops in the field. Specifically intended to be cheap enough to be abandoned after use, the gliders are constructed from plywood, a few aluminum parts for reinforcement and injection molded wing panels. There are two versions of the glider, both with huge payloads. The LG-1K, with a payload capacity of 700 lbs/320 kg and the larger LG-2K, with a payload capacity of 1,600 lbs/725 kg. Wings are folded parallel to the fuselage during transport and then open after release with the help of gas springs. The glider can either do a belly landing in an open area or deploy a parachute from the tail at low altitude to land on the crushable nose.

Gliders like these could be used to deliver supplies after natural disasters, or to remote locations where road travel is difficult or impossible while reducing the flight time required for conventional aircraft. Powered UAVs could even be used to carry/tow a glider to the required release point and then return much lighter and smaller, reducing the required fuel or batteries.

Drones are already used to deliver medical supplies in Rwanda and Ghana, and it’s possible to build your own autonomous unmanned glider. Check out the video after the break to see the big boys in action.

Tags: drone hacks
4:00
Gutted Hoverboard Becomes Formidable Track-Drive Robot
» ‎ Hack a Day

When “hoverboards” first came out, you may have been as disappointed as we were that they did not even remotely fulfill the promises of Back to the Future II. Nothing more than a fancified skateboard, hoverboards are not exactly groundbreaking technology. That doesn’t mean they’re not useful platforms for hacking, though, as this hoverboard to track-propelled robot tank conversion proves.

Most of the BOM for this build came from the junk bin – aluminum extrusions, brackets, and even parts cannibalized from a 3D-printer. But as [pasoftdev] points out, the new-in-box hoverboard was the real treasure trove of components. The motors, the control and driver electronics, and the big, beefy battery were all harvested and mounted to the frame. To turn the wheels into tracks, [pasoftdev] printed some sprockets to fit around the original tires. The tracks were printed in sections and screwed to the wheels. Idlers were printed in sections too, using central hubs and a clever method for connecting everything together into a sturdy wheel. Printed tank tread links finished the rolling gear eventually; each of the 34 pieces took almost five hours to print. The dedication paid off, though, as the 15-kg tank is pretty powerful; the brief video below shows it towing an office chair around without any problems.

We noticed that [pasoftdev] found the assembly of the tread links a bit problematic. These 3D-printed links that are joined by Airsoft BBs might make things a little easier next time.

Tags: robots hacks
1:00
Get Dirty In Your Quest For Power!
» ‎ Hack a Day

A fascinating oddity in the list of potential alternative power sources is the microbial fuel cell, in which the chemical reactions of micro-organisms digesting their food are harnessed to harvest electrons and thus generate electrical current. We’d like to know more, so [Williamolyolson]’s soil microbial fuel cell is a particularly interesting glimpse into this field.

In this type of cell, an anode is placed at the bottom of a container of anaerobic wet soil medium laced with biomass to provide a food source for the bacteria, and a cathode is placed on the top of the medium exposed to air. The cell in this project appears to be a plastic coffee tub, and the electrodes are copper pan scourers. Unlike a chemical battery they do not need to be different materials and they themselves are not part of the chemistry of the cell, instead, they serve to collect and return the electrons to the cell.

The project logs detail a series of time-series measurements and experiments with placement of the cathode. Yield seems to be in the region of 200mV at about 1mA, though peaks as high as 400mV have been seen. It’s clear that this is not a cell that will replace your grid hook-up any time soon, but it still retains a lot of possibilities for use in micropower applications. There has been plenty of work in the field of micropower harvesting using other sources such as small solar cells, and this has the advantage of microbe-laden dirt being ubiquitous and free.

A couple of previous MFCs we’ve brought you include this multi-cell design said to be capable of charging a phone, and this cell that also supports a fish.

Tags: green hacks
October 13, 2019
22:00
Hacking Broken Plastic Parts without a 3D Printer
» ‎ Hack a Day

We’ve all encountered the odd plastic part that is broken and unobtainable. Sure, 3D printers can print big replacement parts, but sometimes you just need to rebuild a very specific piece. [AkBkukU] shows off a technique for doing just that using a process you could almost call manual 3D printing. We’ve seen baking soda used to cure cyanoacrylate glue before, but this technique uses it to build layers of glue that are apparently quite solid.

There’s quite a bit of nuance in the video below, but the basic idea is to put a pile of soda on one side of a piece of tin foil and a glob of glue. You dip the part in glue and then into the soda. Each time you get a little thicker layer of glue.

Afterward, you’ll have to file and otherwise shape the new part, but the fact that it can survive being filed should tell you something. We were reminded of how some people use epoxy to form repair parts and then machine them to the exact shape needed. At the very end of the video he builds up layers on a part he can’t dip. Did it work? Watch it and see.

In addition to the manual 3D printing technique, he demonstrates using baking soda to cure repairs on a knurled knob from an old clock radio. That’s a bit more conventional, but if you haven’t seen it done before, it is nearly miraculous.

Glue is amazing. We’ve seen hot glue do injection molding. There are many more types out there, too.

Tags: repair hacks
19:00
What the Scale? Mouse teardown throws up a few surprises
» ‎ Hack a Day

[Eric Weinhoffer] and his colleagues did a great comparative tear down of the MX Master 3 and the MX Master 2S mice from Logitech. Tear down’s are great fun and often end up teaching us a lot. Looking at the insides of a product can tell us a great deal about how to solve certain problems, or avoid pitfalls. Opening up two versions of the same product provides an even greater wealth of useful information on how product design evolves based on lessons learned from the earlier versions. Logitech is no greenhorn when it comes to Mice design, so the MX Master 2S was already almost perfect. But looking at the Master MX 3 shows where the earlier version fell short of expectations and how it could be improved upon.

These mice have intelligent scroll wheels, which can rotate in either “detente” or “freewheel” modes. Detente allows slower, precise scrolling, while freewheeling allows rapid scrolling. The two mice models have completely different, and interesting, methods of achieving these actions. The older version has a rubber-coated wheel and uses a motor, which turns a cam. This forces a detent ball onto the inside of the wheel for detent mode and releases it for free mode. Once the rubber wears off, the mouse is pretty much headed for the dumpster. The new metal wheel does away with the rubber coating as well as the noisy, slow, and prone to wear-and-tear motor assembly. The actuation is now done using a bi-stable electromagnet. A 25 V pulse magnetizes the coil which sits inside the wheel and it pulls on little metal teeth on the inside rim of the wheel. This gives a noiseless detente feel, without any physical contact. A second 25 V spike de-magnetizes the coil, allowing the scroll wheel to spin freely.

[Eric] points out several incremental changes in design which have resulted in improved ergonomics. He also uncovers a few nuggets of useful information. The use of interchangeable mold inserts help make molds last longer while still offering the flexibility to make changes in the molded part. It’s interesting to see special components being used for withstanding vibration and high-G forces. Some of these insights can be useful for those moving from prototyping to production. There’s one puzzling feature on the new PCB that [Eric] cannot figure out. There is a 15 mm scale screen-printed over the blue tooth antenna. If you have an answer on its purpose, let us know in the comments below.

If you are left-handed (which makes 10% of us), you’re out of luck with these right-handed mice and might like to sign one of the several online petitions demanding lefty versions.

Tags: teardown
16:00
Hackaday Links: October 13, 2019
» ‎ Hack a Day

Trouble in the Golden State this week, as parts of California were subjected to planned blackouts. Intended to prevent a repeat of last year’s deadly wildfires, which were tied in part to defective electrical distribution equipment, the blackouts could plunge millions in the counties surrounding Sacramento into the dark for days. Schools have canceled classes, the few stores that are open are taking cash only, and hospitals are running on generators. It seems a drastic move for PG&E, the utility that promptly went into bankruptcy after being blamed for last year’s fires, but it has the support of the governor, so the plan is likely to continue as long as the winds do. One group is not likely to complain, though; California amateur radio operators must be enjoying a greatly decreased noise floor in the blackout areas, thanks to the loss of millions of switch-mode power supplies and their RF noise.

Good news, bad news for Fusion 360 users. Autodesk, the company behind the popular and remarkably capable CAD/CAM/CAE package, has announced changes to its licensing scheme, which went into effect this week. Users no longer have to pay for the “Ultimate” license tier to get goodies like 5-axis machining and generative design tools, as all capabilities are now included in the single paid version of Fusion 360. That’s good because plenty of users were unwilling to bump their $310 annual “Standard” license fee up to $1535 to get those features, but it’s bad because now the annual rate goes to $495. In a nice nod to the current userbase, those currently on the Standard license, as well as early adopters, will get to keep the $310 annual rate as long as they renew, and Ultimate users will see a $1040 price drop. As for the current base of freeloaders like yours truly, fear not: Fusion 360 is still free for personal, non-commercial use. No generative design or tech support for us, though.

You might have had a bad day at the bench, but was it as bad as Román’s? He tipped us off to his nightmare of running into defective Wemos D1 boards – a lot of them. The 50 boards were to satisfy an order of data loggers for a customer, but all the boards seemed caught in an endless reboot loop when plugged into a USB port for programming. He changed PCs, changed cables, but nothing worked to stop the cycle except for one thing: touching the metal case of the module. His write up goes through all the dead-ends he went down to fix the problem, which ended up being a capacitor between the antenna and ground. Was it supposed to be there? Who knows, because once that cap was removed, the boards worked fine. Hats off to Román for troubleshooting this and sharing the results with us.

Ever since giving up their “Don’t be evil” schtick, Google seems to have really embraced the alternative. Now they’re in trouble for targeting the homeless in their quest for facial recognition data. The “volunteer research studies” consisted of playing what Google contractors were trained to describe as a “mini-game” on a modified smartphone, which captured video of the player’s face. Participants were compensated with $5 Starbucks gift cards but were not told that video was being captured, and if asked, contractors were allegedly trained to lie about that. Contractors were also allegedly trained to seek out people with dark skin, ostensibly to improve facial recognition algorithms that notoriously have a hard time with darker complexions. To be fair, the homeless were not exclusively targeted; college students were also given gift cards in exchange for their facial data.

For most of us, 3D-printing is a hobby, or at least in service of other hobbies. Few of us make a living at it, but professionals who do are often a great source of tips and tricks. One such pro is industrial designer Eric Strebel, who recently posted a video of his 3D-printing pro-tips. A lot of it is concerned with post-processing prints, like using a cake decorator’s spatula to pry prints off the bed, or the use of card scrapers and dental chisels to clean up prints. But the money tip from this video is the rolling cart he made for his Ultimaker. With the printer on top and storage below, it’s a great way to free up some bench space.

And finally, have you ever wondered how we hackers will rebuild society once the apocalypse hits and mutant zombie biker gangs roam the Earth? If so, then you need to check out Collapse OS, the operating system for an uncertain future. Designed to be as self-contained as possible, Collapse OS is intended to run on “field expedient” computers, cobbled together from whatever e-waste can be scrounged, as long as it includes a Z80 microprocessor. The OS has been tested on an RC2014 and a Sega Master System so far, but keep an eye out for TRS-80s, Kaypros, and the odd TI-84 graphing calculator as you pick through the remains of civilization.

Tags: hackaday links

14:53
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu
» ‎ Bugtraq

Posted by Apple Product Security on Oct 13
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu

Swift 5.1.1 for Ubuntu is now available and addresses the following:

Foundation
Available for: Ubuntu 14.04, 16.04 and 18.04
Impact: Incorrect management of file descriptors in URLSession could
lead to inadvertent data disclosure
Description: This issue was addresses by updating incorrect
URLSession file descriptors management logic to match Swift 5.0.
CVE-2019-8790: Apple

Installation note:

Swift...

Tags:
14:49
[SECURITY] [DSA 4539-3] openssl regression update
» ‎ Bugtraq

Posted by Salvatore Bonaccorso on Oct 13
-------------------------------------------------------------------------
Debian Security Advisory DSA-4539-3 security () debian org
https://www.debian.org/security/ Salvatore Bonaccorso
October 13, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : openssl
Debian Bug : 941987

The update for openssl...

Tags:

13:00
Shapeshifter – An Open Source Drum Machine
» ‎ Hack a Day

With microcontrollers growing ever more powerful each new generation, things that were mere pipedreams before are now readily possible. The Shapeshifter drum machine is a perfect example.

Shapeshifter’s design is open-source, with everything available on Github for the curious musical tinkerers out there. The device is built around a PCB with only through-hole components, making assembly easy for even the least experienced enthusiasts out there. A Teensy 3.6 is then slotted into the socket on the board, providing 180MHz of grunt to run the show. It’s an excellent choice, as the Teensy platform has a huge range of libraries which make it simple to work with audio.

Being open-source, not only is it a cinch to make your own, but there’s plenty of room to remix the design to your personal tastes. There’s even a breadboarding area and the capability to add an expansion card for even more possibilities. Some users have even gone so far as to add displays and filter mods to really open things up.

We love a good drum machine at Hackaday, from the Amstrad-based to pocket-sized wonders. If you’ve got a build of your own, be sure to drop it in the tips line.

The HackadayPrize2019 is Sponsored by:

Tags: the hackaday prize
10:00
Nixie Clock Failure Analysis, [Dalibor Farný] Style
» ‎ Hack a Day

We’ve become sadly accustomed to consumer devices that seem to give up the ghost right after the warranty period expires. And even when we get “lucky” and the device fails while it’s still covered, chances are that there will be no attempt to repair it; the unit will be replaced with a new one, and the failed one will get pitched in the e-waste bin.

Not every manufacturer takes this approach, however. When premium quality is the keystone of your brand, you need to take field failures seriously. [Dalibor Farný], maker of high-end Nixie tubes and the sleek, sophisticated clocks they plug into, realizes this, and a new video goes into depth about the process he uses to diagnose issues and prevent them in the future.

One clock with a digit stuck off was traced to via failure by barrel fatigue, or the board material cracking inside the via hole and breaking the plated-through copper. This prompted a board redesign to increase the diameter of all the vias, eliminating that failure mode. Another clock had a digit stuck on, which ended up being a short to ground caused by pin misalignment; when the tube was plugged in, the pins slipped and scraped some solder off the socket and onto the ground plane of the board. That resulted in another redesign that not only fixed the problem by eliminating the ground plane on the upper side of the board, but also improved the aesthetics of the board dramatically.

As with all things [Dalibor], the video is a feast for the eyes with the warm orange glow in the polished glass and chrome tubes contrasting with the bead-blasted aluminum chassis. If you haven’t watched the “making of” video yet, you’ve got to check that out too.

Thanks for the tip, [Alex].

Tags: clock hacks
7:00
Prusa Unveils New Mini 3D Printer, Shakes Up The Competition
» ‎ Hack a Day

For the last couple of years, consumer desktop 3D printer choices in the under $1,000 USD range have fallen into two broad categories: everything bellow $500 USD, and the latest Prusa i3. There are plenty of respectable printers made by companies such as Monoprice and Creality to choose from on that lower end of the scale. It wasn’t a luxury everyone could justify, but if you had the budget to swing the $749 for Prusa’s i3 kit, the choice became obvious.

Of course, that was before the Prusa Mini. Available as a kit for just $349, it’s far and away the cheapest printer that Prusa Research has ever offered. But this isn’t just some rebranded hardware, and it doesn’t compromise on the ideals that have made the company’s flagship machine the de facto open source FDM printer. For less than half the cost of the i3 MK3S, you’re not only getting most of the larger printer’s best features and Prusa’s renowned customer support, but even capabilities that presumably won’t make it to the i3 line until the MK4 is released.

Josef Průša was on hand to officially unveil his latest printer at the 2019 East Coast Reprap Festival, where I got the chance to get up close and personal with the diminutive machine. While it might be awhile before we can do a full review on the Mini, it’s safe to say that this small printer is going to have a big impact on the entry-level market.

A Simplified Design
Considering the huge price drop, you might expect the Prusa Mini to have removed many of the features that made the recent entries into the i3 family so popular. But for the most part, the Mini should deliver more or less the same experience Prusa owners have come to expect.
The Prusa Mini uses a 3:1 geared Bowden extruder
That means automatic mesh bed leveling via inductive probe, a magnetic spring steel print bed (in both smooth and textured variants), near-silent operation thanks to the Trinamic stepper drivers, out of the box support in PrusaSlicer, and the self-checks and safety features that far too often are missing on lower-cost printers.

Of course, there has to be some cuts somewhere. For one, the Prusa Mini does away with the sensor (though it’s available as an option) that pauses the printer if it runs out of filament. This was one of the key upgrades made in the i3 MK3, and is undeniably a nice feature to have on long prints. But considering how few other printers even offer this capability, the fact that it doesn’t come standard on the Mini certainly doesn’t put it at a disadvantage. The fact that it’s even available as an official option and not something you have to hack together yourself is actually an improvement over other printers in this price range.

To reduce weight, the Prusa Mini also switches from a direct drive to a Bowden style extruder. Again, this is not particularly unusual at this price, and is very reminiscent of the arrangement used on the Monoprice Mini. But it will certainly be an adjustment for Prusa owners that are used to a direct drive extruder. For example, Bowden extruders tend to be somewhat more finicky and are notoriously difficult to get working with flexible filaments. Incidentally, the switch to a Bowden extruder also means the Prusa Mini is not compatible with the company’s Multi Material Upgrade (MMU).

Finally, it’s worth noting that the Prusa Mini forgoes an integrated power supply and instead uses a laptop-style “power brick”. While a somewhat unglamorous change, this isn’t likely to be a deal-breaker for anyone. But certainly something to consider when thinking of where you’ll put the machine, or when designing an enclosure for it.
Printrbot called, they want their power supplies back. Now You’re Playing with Power
While the mechanical aspects of the Prusa Mini have been simplified compared to its larger predecessor, the electronics have gone in the opposite direction. At least in that respect, the new printer is actually quite a bit more advanced than the i3 MK3S. It stands to reason that the Mini will serve as something of a test bed for the electronics that will go into the next generation of Prusa printers, so prospective buyers would be wise to expect some growing pains.
The display is bright and easily visible from a distance.
The Mini features a completely revamped control board and accompanying user interface. The new 32-bit ARM STM32F407 equipped “Buddy” controller is vastly more powerful than the 8-bit board Prusa uses in the i3, and thanks to its onboard Ethernet and USB, can perform all the tasks you’d currently have to do with a Raspberry Pi running OctoPrint.

Or at least, it will in the future. Prusa says those more advanced features, including webcam support, are coming down the line as a software update. Speaking of which, the Buddy board is able to pull its own firmware updates down over the Internet; so no more plugging it into the computer to manually flash the latest hex file. With the DIY addition of an ESP module, it’ll even be able to do that over WiFi.

Increased computational capabilities in the controller also enable some relatively flashy graphics on the printer’s 2.8 inch LCD. Not only does the 320×240 screen look worlds better than the i3’s rather dated display during normal operation, but it allows for 3D rendered previews of the selected STL. Users will be able to visually confirm what they’re about to print, rather than having to remember the file name of a particular object.

Though for all the new capabilities of the Buddy board, there is at least one omission that long-time Prusa owners might find odd: there’s no support for SD cards. STLs are now loaded either over the network or from USB Mass Storage. Arguably this is an improvement, but still somewhat unexpected given that nearly every desktop 3D printer since the MakerBot Cupcake has had an SD slot.
A New Member of the Family
One thing made abundantly clear was that the Prusa Mini is not intended to compete with the i3 line, much less serve as a replacement for it. Josef Průša says that the i3 MK3S is still going strong, and will continue to be updated as time goes on. He also says the team is working on a new CoreXY printer codenamed “Prusa XL”, but that we’ll have to wait until next year before we see anything concrete on that one.

The Mini is envisioned as an ideal starter printer, or perhaps even as a secondary printer so you can start tackling big jobs in parallel. Prusa says its small size and integrated remote control capabilities also make it an ideal choice for print farms. Whatever people will be buying them for, at this price, we expect the Prusa Mini is going to be in high demand for the foreseeable future.

Tags: printer hacks

5:22
Joomla Sumoku 3.9.8 SQL Injection
» ‎ Packet Storm Security Exploits

Joomla Sumoku component version 3.9.8 suffers from a remote SQL injection vulnerability.
Tags:

5:22
Joomla Sumoku 3.9.8 SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla Sumoku component version 3.9.8 suffers from a remote SQL injection vulnerability.
Tags:

5:22
Joomla Sumoku 3.9.8 SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla Sumoku component version 3.9.8 suffers from a remote SQL injection vulnerability.
Tags:

4:11
Joomla Vemod News Mailer 1.0 SQL Injection
» ‎ Packet Storm Security Exploits

Joomla Vemod News Mailer component version 1.0 suffers from a remote SQL injection vulnerability.
Tags:

4:11
Joomla Vemod News Mailer 1.0 SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla Vemod News Mailer component version 1.0 suffers from a remote SQL injection vulnerability.
Tags:

4:11
Joomla Vemod News Mailer 1.0 SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla Vemod News Mailer component version 1.0 suffers from a remote SQL injection vulnerability.
Tags:

4:00
Not All 7-Segment Displays Are Electronic
» ‎ Hack a Day

There are a variety of means by which numbers can be displayed from an electronic circuit, and probably the most ubiquitous remains the seven-segment display. Take seven LEDs, lamps, LCDs, VFD segments or mechanical flip-dot style units in the familiar rectangular figure eight, and your microcontroller or similar can display numbers. There are a variety of different interfaces, but at most all that is needed is a level shifter and a driver.

Sometimes though we encounter a completely novel 7-segment display, and such is the case with [Fhuable]’s all mechanical single digit display. It bears a superficial resemblance to a flipdot display, but instead of a magnetic actuator, it instead uses a complex system of gears and cams to flip the segments sequentially from the turning of a small crank. It appears to be the same mechanism he’s used in his subscription counter project whose video we’ve placed below the break, and it is truly a thing of beauty. We’re not entirely certain how useful it would be as a general-purpose display in its current form, however, we can see it being adapted with relative ease. A clock might, for example, be an eye-catching project.

Most displays that make it here have some electrical components, so it’s unusual to see an entirely mechanical one. But that’s not necessarily always the case.

Thanks [Mike Horne] for the tip.

Tags: Hardware

3:11
Joomla MediaLibrary 1.5.26 SQL Injection
» ‎ Packet Storm Security Exploits

Joomla MediaLibrary component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

3:11
Joomla MediaLibrary 1.5.26 SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla MediaLibrary component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

3:11
Joomla MediaLibrary 1.5.26 SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla MediaLibrary component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

2:22
Joomla MisterEstate 1.5.26 SQL Injection
» ‎ Packet Storm Security Exploits

Joomla MisterEstate component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

2:22
Joomla MisterEstate 1.5.26 SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla MisterEstate component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

2:22
Joomla MisterEstate 1.5.26 SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla MisterEstate component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

1:00
DIY MIDI Looper Controller Looks Fantastic!
» ‎ Hack a Day

Due to pedalboard size, complicated guitar pedals sometimes reduce the number of buttons to the bare minimum. Many of these pedals are capable of being controlled with an external MIDI controller, however, and necessity being the mother of invention and all, this is a great opportunity to build something and learn some new skills at the same time. In need of a MIDI controller, Reddit user [Earthwin] built an Arduino powered one to control his Boss DD500 Looper pedal and the result is great looking.

Five 16×2 LCD screens, one for each button, show the functionality that that button currently has. They are attached (through some neat wiring) to a custom-built PCB which holds the Arduino that controls everything. The screens are mounted to an acrylic backplate which holds the screens in place while the laser-cut acrylic covers are mounted to the same plate through the chassis. The chassis is a standard Hammond aluminum box that was sanded down, primed and then filler was used to make the corners nice and smooth. Flat-top LEDs and custom 3D printed washers finish off the project.

[Earthwin] admits that this build might be overkill for the looper that he’s using, but he had fun building the controller and learning to use an Arduino. He’s already well on his way to building another, using the lessons learned in this build. If you want to build your own MIDI controller, this article should help you out. And then you’re ready to build your controller into a guitar if you want to.

[Via Reddit]

Tags: Hardware
October 12, 2019
22:10
Quality Sound-Proof Cans From Personal Protective Equipment
» ‎ Hack a Day

Working in a noisy office can be distracting. To combat the problem in his workplace [Rikard Anglerud] bought himself a pair of 3M ear defenders. They were good, but not quite good enough to completely extinguish the noise, so he inserted the drivers from a pair of cheap headphones and played a low-level white noise. This prototype proved effective, so he returned to the project and produced a much nicer pair that approach much more costly cans in their execution.

[Rikard’s] first set of headphones left something to be desired in the quality department. The second set followed with a pair of better-quality drivers sourced online, and more care was taken with cable routing and in their fitting. Finally some filler was used to remove the moulded 3M branding, and make them look more hi-fi than workwear.

From an audiophile perspective these cans might not approach a very high quality pair because their drivers are unlikely to be matched to the acoustic properties of their enclosures. But it sounds as though he’s achieved an adequate result despite that, and completely satisfied his need to exclude office noise.

Tags: home entertainment hacks
19:00
Using This Micro Deltesian is Easy For Children To Use
» ‎ Hack a Day

[Ekaggrat Singh Kalsi] submits this interesting printer he built for his daughter to use. He admits that the project started simply out of curiosity about the strange deltesian movement. In this configuration, the X and Z-axis are a delta mechanism while the Y-axis is a regular Cartesian bed on rails. There’s not a load of advantages to this movement, but it is really neat.

Eventually, he had a hammer in search of a nail and decided to make the printer easy enough for his daughter to use. To this end, he added a few kid-friendly modifications. The unheated bed is removable and snaps in and out of place with magnets. Considerable attention was paid to the filament loading and unloading to make it easy for small hands to perform the process. This was accomplished through a lever based latch mechanism.

As you can see in the video after the break, the project was a success, and his daughter is growing up with access to her very own 3D printer. If you’re curious abou the classic delta robot, check out this golf ball sorter.

Tags: printer hacks
16:00
Flying Batteries for Drones
» ‎ Hack a Day

Power is the bane of drone pilots. You’d like to fly longer which means a bigger battery. But a bigger battery will weigh more which leads to less flight time. You have to strike a balance and for most consumer drones that balance is about 20 minutes of flight time, more or less. Researchers at Berkeley have a different idea: don’t use a bigger battery, but simply replace the battery in flight.

The idea isn’t completely new. After all, many planes refuel in flight — a technically sophisticated operation, but it occurs every day. The scheme here is to have a primary battery and a secondary battery. When the secondary battery is low, the drone ejects it while running on the primary battery. Another secondary battery flies to the drone and docks with it becoming the new main power source.

In theory, it sounds pretty simple. In practice, though, you really have two drones. The main drone and a smaller one that carries the battery back and forth. Of course, you also need a way for the drones to find each other and dock.

The devil is in the details. Do you put a separate battery on the flying battery or do you let it sip from the payload’s charge? Do you fly batteries away gracefully or just dump them? How do they find each other? All things for a designer to consider. You also don’t want to put two wildly mismatched batteries in parallel, so the design uses some diodes, a FET, and a relay to keep the power source to one battery at a time.

We’ve looked at hybrid drones that combine electric motors with internal combustion engines to try to solve this problem. Or just throw in the towel and use gas.

Tags: drone hacks
13:00
The World’s Smallest Vacuum in an Altoids Tin
» ‎ Hack a Day

There’s been a lot of Altoids tin hacks over the years, but a vacuum cleaner in a tin is something new. In [Toby Bateson]’s first project on Hackaday, he used simple household items to create a functioning vacuum cleaner to use for sucking crumbs out of your keyboard or paper punch holes off your desk.

The vacuum features a retractable suction tube, a low-profile switch, and a bagless waste collection system (the waste is stored and discarded out from the tin itself). A brushed motor and impeller provide the airflow. A scrap of a beer can mounted on the shaft is used for an impeller blade, and two bolts with a thin metal sheet between them are made into a switch (the instructions recommend you finish your drink before using the scrap metal). A sponge is used for filtering the dirt from the motor while a hole is cut out of the top of the tin to provide airflow.

[Bateson] is looking to put his name in the world record book for the world’s smallest vacuum tube, as he recently created an even smaller vacuum in a 1cc tube.

“Oh dear, I’ve spilled something on my desk, whatever am I going to do? Luckily, I have my vacuum cleaner in an Altoids tin…”

The HackadayPrize2019 is Sponsored by:

Tags: home hacks
10:00
Robotic Laundry Line Reels You In
» ‎ Hack a Day

It may not be a laundry-folding robot, but this robotic launders line build by [Radical Brad Graham] is pretty neat. He has a 75-foot hanging laundry line from his house to a woodshed, and decided to roboticize it using some bits that were lying around. The result is a simple build that adds push-button control to pull the line back and forward, making it easier to hang everything out to dry. It’s a simple build, but [Brad] did a great job of documenting what he did and why, from mounting the posts that support the line to wiring up the control buttons.

The heart of this build is an old motor from a wheelchair. Although the motor is over 20 years old, it still works well and was ideal for this sort of slow-speed, high-torque requirement That’s especially true when you consider the weight of the 75-foot line loaded with wet clothes. [Brad] decided to undervolt the engine so it would run off a 12 V battery. At the moment it is running off a car battery, but it is built to run from a smaller battery that is charged from a solar panel. After all, this will be used when the sun is out, so solar power makes perfect sense.

Tags: how-to

7:44
Joomla Google Maps 1.0.4 SQL Injection
» ‎ Packet Storm Security Exploits

Joomla Google Maps component version 1.0.4 suffers from a remote SQL injection vulnerability.
Tags:

7:44
Joomla Google Maps 1.0.4 SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla Google Maps component version 1.0.4 suffers from a remote SQL injection vulnerability.
Tags:

7:44
Joomla Google Maps 1.0.4 SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla Google Maps component version 1.0.4 suffers from a remote SQL injection vulnerability.
Tags:

7:22
Joomla Mad4Joomla 1.1.x SQL Injection
» ‎ Packet Storm Security Exploits

Joomla Mad4Joomla component version 1.1.x suffers from a remote SQL injection vulnerability.
Tags:

7:22
Joomla Mad4Joomla 1.1.x SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla Mad4Joomla component version 1.1.x suffers from a remote SQL injection vulnerability.
Tags:

7:22
Joomla Mad4Joomla 1.1.x SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla Mad4Joomla component version 1.1.x suffers from a remote SQL injection vulnerability.
Tags:

7:00
Dealing with Missing Pin Allocations
» ‎ Hack a Day

Blindsided by missing pin allocations? Perhaps you’re working on a piece of hardware and you notice that the documentation is entirely wrong. How can you get your device to work?

[Dani Eichhorn]’s troubles began when running an IoT workshop using a camera module. Prior to the work, no one had through to check if all of the camera modules ordered for the participants were the same. As it turns out, the TTGO T-CAM module had a number of revisions, with some even receiving a temperature/pressure sensor fixed on top of the normal board.

While the boards may have looked the same, their pin allocations were completely different.Changing the pin numbers wouldn’t have been difficult if they were simply numbered differently, but because the configurations were different, errors started to abound: Could not initialize the camera

As it turns out, even the LillyGo engineers – the manufacturers of the board – may have gotten a bit lost while working on the pin allocations, as [Eichhorn] was able to find some of the pins printed right onto the PCB, hidden behind the camera component.

To find information not printed on the board, a little more digging was required. To find the addresses of the devices connected to the I2C bus, running a program to find peripherals listening on the bus did the trick. This was able to print out the addresses of the SSD1306 OLED display driver and the microphone for the board at hand.

To find the pins of peripherals not printed on the PCB or hidden on the silkscreen, a GPIO scanner did the trick. This in particular worked for finding the PIR (passive infrared) motion sensor.

We picked up a few tips and tricks from this endeavor, but also learned that reverse-engineering anything is hard, and that there isn’t any one method for finding pin allocations when the documentation’s missing.

Tags: Hardware

6:13
Joomla Cactus 1.2.0 SQL Injection
» ‎ Packet Storm Security Exploits

Joomla Cactus component version 1.2.0 suffers from a remote SQL injection vulnerability.
Tags:

6:13
Joomla Cactus 1.2.0 SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla Cactus component version 1.2.0 suffers from a remote SQL injection vulnerability.
Tags:

6:13
Joomla Cactus 1.2.0 SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla Cactus component version 1.2.0 suffers from a remote SQL injection vulnerability.
Tags:

4:00
Make Your Own Plasma Cutter
» ‎ Hack a Day
Of all the tools that exist, there aren’t many more futuristic than the plasma cutter, if a modern Star Wars cosplay if your idea of futuristic. That being said, plasma cutters are a powerful tool capable of making neat cuts through practically any material, and there are certainly worst ways to play with high voltage.

Lucky enough, [Plasanator] posted their tutorial for how to make a plasma cutter, showing the steps through which they gathered parts from “old microwaves, stoves, water heaters, air conditioners, car parts, and more” in the hopes of creating a low-budget plasma cutter better than any on YouTube or from a commercial vendor.

The plasma cutter does end up working up quite an arc, with the strength to slice through quarter-inch steel “like a hot knife through butter”.

Its parts list and schematic divide the systems into power control, high current DC, low voltage DC, and high voltage arc start:
- The power control contains the step down transformer and contactor (allows the DC components to come on line)
- The high current DC contains the bridge rectifier, large capacitors, and reed switch (used as a current sensor to allow the high voltage arc to fire right when the current starts to travel to the head, shutting down the high voltage arc system when it’s no longer necessary)
- The low voltage DC contains the power switch, auto relays, 12V transformer, 120V terminal blocks, and a terminal strip
- The high voltage arc start contains the microwave capacitor and a car ignition coil
At the cutting end, 13A is used to cut through quarter-inch steel. Considering the considerably high voltage cutter this is, a 20 A line breaker is needed for safety.

Once the project is in a more refined state, [Plasanator] plans on hiding components like the massive capacitors and transformer behind a metal or plastic enclosure, rather than have them exposed. This is mainly for safety reasons, although having the parts exposed is evocative of a steampunk aesthetic.

In several past designs, stove coils were used as current resistors and a Chevy control module as the high voltage arc start. The schematic may have become more refined with each build, but [Plasanator]’s desire to use whatever components were available certainly has not disappeared.

[Thanks to jafinch78 for the tip!]

Tags: Hardware

3:11
Joomla SwPhotoGallery 1.5.26 SQL Injection
» ‎ Packet Storm Security Exploits

Joomla SwPhotoGallery component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

3:11
Joomla SwPhotoGallery 1.5.26 SQL Injection
» ‎ Packet Storm Security Recent Files

Joomla SwPhotoGallery component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

3:11
Joomla SwPhotoGallery 1.5.26 SQL Injection
» ‎ Packet Storm Security Misc. Files

Joomla SwPhotoGallery component version 1.5.26 suffers from a remote SQL injection vulnerability.
Tags:

1:00
How to make a living with Embedded Systems
» ‎ Hack a Day

One of the biggest dreams anyone has is to make a living doing what they love. For all hackers, makers, and DIYers with a passion for embedded systems, it may make sense initially to pursue embedded systems design as a possible career, but without so much information on the types of qualifications or steps needed to actually secure a job offer, it may seem daunting to try and break into the field.

YouTuber [iAyan Pahwa] currently works as an embedded software engineer, having been in the field for two years, with prior experience as a hobbyist working with microcontrollers, motors, and programming in the embedded domain. In this video, embedded below, he provides his take on what you need to know to get yourself that first job.
Benefits
Embedded systems jobs tend to pay well and have plenty of opportunities to work on interesting projects. Since consumer electronics exist in all industries, you won’t have any lack of companies looking to hire someone with embedded systems knowledge.
Embedded Hardware
These roles typically deal with schematic layout, embedded board design, power electronics, PCB design, and tasks that rely on the analog domain. You’ll need to be able to use some CAD and EDA software and have experience with analog debugging.

While there are tons of opportunities in embedded hardware, [Pahwa] mostly sticks to talking about breaking into embedded software.
Embedded Software
Most software engineers work in C, working on boot loaders, middleware, or kernel development. Classes to look for include CS50 (for basic C), learning to program device drivers, and systems programming.

In addition, learning to program microcontrollers is essential. Even if you end up going into VLSI or electronic control automation, at least learning to program an Arduino is a very helpful step to digging deeper into the hardware aspects of embedded systems. While Arduino is programmed in a C++ based language, programmers familiar with C shouldn’t have any issue with the syntax.

Learning to program microcontrollers in C or Assembly is necessary to be able to optimize your code. Being able to understand computer architecture and registers increases your knowledge of the internal design of microcontrollers and how they are used in production. Common questions you will encounter include stack pointers, left and right shifting, moving registers, and how to control memory.

Beyond understanding the different processors used in industry, understanding operating systems is also helpful, especially learning the ins and outs of Linux. You’ll probably be asked about system calls, filesystems, and command line during interviews to test your comfort within the Linux environment. Hardware descriptor languages (HDLs) like Verilog or VHDL are also common skills required for embedded software engineers.
Takeaways
[Pahwa] goes a lot more into detail about specific tips for students studying embedded systems looking to ace their interviews for embedded systems roles, as well as for anyone uncertain about whether they’re truly passionate about this industry.

A lot of the skills that embedded systems engineers have are picked up, and chances are if you’re already a hobbyist, you may already be familiar with many of the tools and processes necessary for embedded systems. Skills like debugging Assembly and working with data sheets for unfamiliar microcontrollers can only come with practice and time, so spending time working on projects and familiarizing yourself with existing environments is crucial for success in the field.

Most of all, staying motivated and seeking the expertise of others already in the field is a huge asset. Since the field is so broad, there is no limit to the opportunities you’ll find and the resources available for an aspiring embedded systems engineer.

Tags: how-to

Skip to page: 1 2 3 ... 928

Feeds

Unread items (22)

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Recent items

Tags:

Tags:

Tags: arduino hacks

Tags: Hardware

Tags: engineering

Tags: Hardware

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags: