Old Laptop Gets New Lease on Life with Raspberry Pi

It seems not a day goes by that we don’t see somebody cramming a Raspberry Pi into some unwilling piece of consumer electronics. But despite being a pretty obvious application for the diminutive ARM board, we don’t often see it installed in an actual computer. Which makes this very clean Raspberry Pi laptop conversion by [Sherbethead2010] all the more interesting.

The first step involved taking a Dremel to the Dell’s chassis and essentially leveling out the entire internal volume. The only component that got reused was the fan, and even that appears to be relocated, so all the mounting posts were just standing in the way of progress.

[Sherbethead2010] mounted the Raspberry Pi towards the rear of the case so its USB and Ethernet ports would be available from the outside, and installed a driver board for the original Phillips LP171 LCD panel in the old drive bay. Power is provided by two custom 18650 battery packs connected to dedicated buck converters, along with an onboard charge controller to safely top them off.

Rather than trying to adapt the original input devices, [Sherbethead2010] decided to take the easy route and installed a Rii K22 wireless keyboard with integrated track pad into the top of the laptop. It turned out to be an almost perfect fit, and beyond the keys being slightly off-center, at first glance it looks like it could be stock.

The last time we saw a Raspberry Pi so well integrated into a real laptop, it was to create a functioning version of one of the props from Hackers. While that build was a joy for its own reasons, it’s hard not to be impressed with how unassuming this computer looks after all the work that’s been done to it.

Any Remote Can Be A Universal Remote

Everyone has a stack of old infra-red remote controllers lying around, for devices that have long since shuffled off this mortal coil. Containing little more than an application-specific encoder chip, keyboard, and IR LED, they’re of little use unless you happen to have another device that uses the same encoding scheme. For [RiYa] though they represent an opportunity, to be repurposed into controllers for other devices. How? Hijack the bitstream with an ATtiny13 microcontroller, re-encode it, and send it out afresh into the ether from the LED. It’s a gloriously simple solution which we can’t help applauding, and has the potential to cheaply replace all those universal remotes.

The ATtiny itself along with a buffer to drive the LED is mounted on a small breakout board and concealed within the shell of the remote. We don’t learn much about the power supply arrangement, but we’d expect the ATtiny to be on its most power-sipping behaviour as anything which would shorten the battery life of a remote would be unlikely to be popular with a couch potato forced to change AA cells every few weeks. There’s a plan for a learning mode to make it more like a commercial universal remote, but for now the translation is hard coded.

Of course, should you lack a handy old remote to play with, you can always try a smartphone.

ICANN blocks controversial sale of .org domain to a private equity firm

Enlarge (credit: dalton00 / Getty)

The Internet Corporation for Assigned Names and Numbers, the non-profit organization that oversees the Internet's domain name system, has rejected a controversial proposal to sell the .org domain to a private equity group for more than $1 billion. It's a serious—quite possibly fatal—blow to a proposal that had few supporters besides the organizations that proposed it.

Currently, the .org domain registry is run by the Public Interest Registry, a non-profit subsidiary of another non-profit called the Internet Society. PIR was created in 2002 to run the .org domain and has been doing so ever since. But last fall, the Internet Society stunned the non-profit world by announcing it would sell the PIR—and, effectively, ownership of the .org domain—to a new and secretive private equity firm called Ethos Capital for more than $1 billion.

The announcement created a swift and powerful backlash. In its resolution formally rejecting the transaction, ICANN says it received its first letter opposing the deal just two days after it was announced. The group would eventually receive letters from at least 30 groups opposing the deal, as well as numerous negative comments during public hearings. Meanwhile, ICANN says, the deal has received "virtually no counterbalancing support except from the parties involved in the transaction and their advisors."

Read 15 remaining paragraphs | Comments

Using an FPGA to Glitch the Olimex LPC-P1343

After trying out hardware hacking using an FPGA to interface with target hardware, [Grazfather] was inspired to try using the iCEBreaker (one of the many hobbyist FPGAs to have recently flooded the market) to build a UART-controllable glitcher for the Olimex LPC-P1343.

FPGA Modules (The cmd module intercepts what the host computer sends over UART, the resetter holds the reset line until the target is reset, the delay starts counting on reset and waits for a configured number of cycles before sending its signal, the trigger waits for the delay to finish before telling the pulse module to send a pulse, and the pulse works similar to the delay module and outputs to the power multiplexer.)

When the target board boots up, the bootROM reads the flash and determines whether the UART goes to a shell and if the shell can be used to read out the flash. This is meant for developing firmware and debugging it in the bootloader, only flashing a version when the firmware is production-ready. The vulnerability is that only a specific value read from address 0x2FC and the state of a few pins can lock the bootloader in the expected way, and any other value at the address causes the bootROM to consider the device unlocked. Essentially, the mechanism is the opposite of how a lock ought to work.

The goal is to get the CPU to misread the flash at the precise moment it is meant to be reading the specific value, then jumping to the bootloader in the unlocked state. The FPGA can be used as a tool between the host machine and target board, communicating via UART. The FGPA can support configuring the delay between resetting the target board and pulsing a ‘glitch voltage’, as well as resetting the target board and activating the glitch. The primary reasons for using the FPGA over a different microcontroller are that the FPGA allows for precise timing (83.3ns precision) and removes worries about jitters (a Raspberry Pi might have side effects from OS scheduling and other processes and microcontrollers might have interrupts messing up the timing).

The logic analyzer view

To simulate the various modules, [Grazfather] used Icarus Verilog as well as GTKWave to observe the waveforms generated. A separate logic analyzer observes the effects on real hardware.

With enough time, it is possible to brute force any combination of delay and width until you get a dump of the flash you’re not meant to read. You can check out how the width of the pulse gets wider until the max, when the delay is incremented and the width values are tried again.

LockBit, the new ransomware for hire: a sad and cautionary tale

Enlarge (credit: Getty Images)

Ransomware has emerged as one of the top threats facing large organizations over the past few years, with researchers reporting a more than a fourfold increase in detections last year. A recent infection by a fairly new strain called LockBit explains why: after it ransacked one company’s poorly secured network in a matter of hours, leaders had no viable choice other than to pay the ransom.

A report published by McAfee documents the effectiveness of this newcomer ransomware. Incident responders with Northwave Intelligent Security Operations aided in the analysis. LockBit is most prevalent in countries including the US, the UK, France, Germany, Ukraine, China, India, and Indonesia.

(credit: McAfee)

Attackers started out by researching potential targets with valuable data and the means to make big payouts when faced with the dim prospect of losing access to it. The attackers then used a list of words in hopes of gaining access to one of the accounts. Eventually, they hit the jackpot: an administrative account that had free rein over the entire network. The weak account password, combined with the lack of multi-factor authentication protection, gave the attackers all the system rights they needed.

Read 14 remaining paragraphs | Comments

The Unites States Air Force Would Like You to Hack Into Their Satellite

The Air Force is again holding its annual “Space Security Challenge” where they invite you to hack into a satellite to test their cybersecurity measures. There are actually two events. In the first one, $150,000 is up for grabs in ten prizes and the final event offers a $100,000 purse divided among the three top participants (first place takes $50,000).

Before you get too excited, you or your team has to first qualify online. The qualification event will be over two days starting May 22. The qualifying event is set up a bit like the TV show Jeopardy. There is a board with categories. When a team solves a challenge in a category it receives a flag that is worth points as well as getting to unlock the next challenge. Once a challenge is unlocked however, any team could potentially work on it. There are more rules, but that’s the gist of it. At the end of the event, the judges will contact the top 10 teams who will then each have to submit a technical paper.

One interesting aspect of the value of the flags is that they depend on how many people solve them. More difficult challenges presumably will have fewer flags claimed and their flags will be worth more. So you don’t know how much a flag is worth until after the event is over.

If you qualify you’ll have three weeks to submit your technical paper. It will need to describe your solution to at least five challenges you solved during the event.

The final event will be a DEF CON 28 — if there is a DEF CON this year., or it could be could be online if DEF CON doesn’t materialize physically. It will consist of two parts, of which hacking into a FlatSat in a simulated space environment is the first. If a team is successful at that, they will be eligible for the on-orbit challenge.

Again, to get a payout, you also have to submit a technical paper that is acceptable. There are other requirements. You can be a team of one if you like, but your team leader and the point-of-contact person must be a US citizen and speak English. The team leader can also be the point-of-contact person. If you are under 18 you will need parental consent.

There are also some disqualifying rules. You can’t attack other players. You have to respect open source rules. You can’t hack the infrastructure used to run the contest.

If you are interested in participating, you have until May 24 to register, but since the event starts on May 22, we’d suggest you do so well before then.

Amazon locks down internal employee communications amid organizing efforts

Enlarge / Amazon's headquarters on a sunny day in 2018. (credit: Andrei Stanescu | Getty Images)

Amazon is reportedly (and suddenly) enforcing rules limiting employees' internal communication as workers, critical of the company's behavior, become increasingly outspoken and organized.

Internal listservs with more than 500 participants are now required to move to a moderated model where a manager must approve any content before its distribution, according to emails obtained by Recode.

Amazon had almost 800,000 total employees worldwide as of the end of 2019, a number that does not include the recent addition of another 175,000 temporary warehouse and delivery workers the company just hired to handle increased demand due to COVID-19. Of those 800,000, more than 500,000 are in the United States, and at least 275,000 of those are full-time employees.

Read 5 remaining paragraphs | Comments