Kritik sah

Stock, the Casio W800-H wristwatch ships with dual time modes, multiple alarms, and a stopwatch – useful features for some. However, more is possible if you just know where to look. [Ian] decided to dive under the hood and enable a countdown timer feature hidden from the factory. The hack involves popping open the case of the watch and exposing the back of the main PCB. There, a series of jumpers control various features. [Ian]’s theory is that this allows Casio to save on manufacturing costs by sharing one basic PCB between a variety of watches and enabling features via the jumper selection. With a little solder wick, a jumper pad can be disconnected, enabling the hidden countdown feature. Other features, such as the multiple alarms, can be disabled in the same way with other jumpers, suggesting lower-feature models use this same board too. It’s a useful trick that means [Ian] now always has a countdown timer on his wrist when he needs it. Excuses for over-boiling the eggs will now...

Feeling nostalgic we presume, [Glen Kleinschmidt] set out to build a 640x480x64 VGA controller card from discrete logic chips. If we ignore the 512Kx8 Cypress SRAM video memory, he succeeds, too — and on a very readable, single page A3 schematic . The goal is to interface some of his older 8-bit machines, like the TRS-80 Model 1 and the BBC Micro, but for now he’s running a demo using a 20+ year old PIC16F877 micro. [Glen] provides all the schematics, Gerbers, and C source code on his website should you be inclined to reproduce one for yourself. He has three versions in the works, with various capabilities (there’s a table on his website). As an alternative, one could always use an FPGA or a custom-built chip such as the SSD1963 to generate video for these micros, but sometimes the urge to go retro is too great to resist. We get the feeling that for [Glen], this is a project unto itself, and being able to interface it to his 8-bit computers is just a convenient excuse. This isn’t ...

OX App Suite versions 7.10.4 and below suffer from cross site scripting and server-side request forgery vulnerabilities. OX Guard versions 2.10.4 and below suffer from a denial of service vulnerability. from Packet Storm https://ift.tt/2S8m0xm

Ubuntu Security Notice 4930-1 - Peter Eriksson discovered that Samba incorrectly handled certain negative idmap cache entries. This issue could result in certain users gaining unauthorized access to files, contrary to expected behaviour. from Packet Storm https://ift.tt/3vvg7sp

Piwigo version 11.3.0 suffers from a remote SQL injection vulnerability. from Packet Storm https://ift.tt/2PCD51z

Backdoor.Win32.Agent.oj malware suffers from a code execution vulnerability. from Packet Storm https://ift.tt/3nz6o1L

Microsoft Windows can dupe users into trusting executables with DLL hijacking and privilege escalation issues. from Packet Storm https://ift.tt/336LNrS

Backdoor.Win32.Agent.oj malware suffers from a buffer overflow vulnerability. from Packet Storm https://ift.tt/3e7Utom

Moodle version 3.6.1 suffers from a persistent cross site scripting vulnerability. from Packet Storm https://ift.tt/3eLQPPZ

Backdoor.Win32.Agent.kte malware suffers from a buffer overflow vulnerability. from Packet Storm https://ift.tt/3eI93lJ

Backdoor.Win32.Agent.gmug malware suffers from a heap corruption vulnerability. from Packet Storm https://ift.tt/3eJPKs7

Red Hat Security Advisory 2021-1469-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. from Packet Storm https://ift.tt/3xvbEYC

GNU wget versions prior to 1.1.8 arbitrary file upload and code execution exploit. from Packet Storm https://ift.tt/3vxKVZC

Backdoor.Win32.Agent.ggw malware suffers from a bypass vulnerability. from Packet Storm https://ift.tt/3vvjAXX

Worm.Win32.Delf.hu malware suffers from an insecure permissions vulnerability. from Packet Storm https://ift.tt/3xB2IkC

HEUR.Trojan.Win32.Bayrob.gen malware suffers from an insecure permissions vulnerability. from Packet Storm https://ift.tt/3gNKo1L

from Packet Storm https://ift.tt/2Sgz2ZT

from Packet Storm https://ift.tt/3e2a8Wd

from Packet Storm https://ift.tt/3t5zgzL

from Packet Storm https://ift.tt/3e7FWZQ

This week we’re starting off with a somber note, as Dan Kaminsky passed at only 42 , of diabetic ketoacidosis. Dan made a name for himself by noticing a weakness in DNS response verification that could allow attackers to poison a target DNS resolver’s cache. A theoretical attack was known, where spoofed DNS responses could collide with requests, but Time-To-Live values meant that DNS requests only go out once per eight hours or so. The breakthrough was realizing that the TTL limitation could be bypassed by requesting bogus subdomains, and aiming the spoofed responses at those requests. This simple technique transformed a theoretical attack that would take 87 years to a very real 10 second attack. Check out the period video after the break, where Dan talked about his efforts in getting the problem fixed. What may be the most impressive piece of work is how many different vendors and maintainers he convinced to cooperate while keeping the vulnerability quiet. Because of the seriousn...

ATMegaZero ESP32- S2, showing optional color-coded 40-pin header (top) The ATMegaZero ESP32-S2 is currently being funded with a campaign on GroupGets , and it’s a microcontroller board modeled after the Raspberry Pi Zero’s form factor. That means instead of the embedded Linux system most of us know and love, it’s an ESP32-based development board with the same shape and 40-pin GPIO header as the Pi Zero. As a bonus, it has some neat features like a connector for inexpensive SSD1306 and SH1106-based OLED displays. Being able to use existing accessories can go a long way towards easing a project’s creation, and leveraging that is one of the reasons for sharing the Pi Zero form factor. Ease of use is also one of the goals, so the boards will ship with CircuitPython (derived from MicroPython ), and can also be used with the Arduino IDE. If a microcontroller board using the Pi Zero form factor looks a bit familiar, you might be remembering the original ATMegaZero which was based on t...

For many of us the passing of the floppy disk is unlamented, but there remains a corps of experimenters for whom the classic removable storage format still holds some fascination. The interface for a floppy drive might have required some complexity back in the days of 8-bit microcomputers, but even for today’s less accomplished microcontrollers it’s a surprisingly straightforward hardware prospect. [David Hansel] shows us this in style, with a floppy interface, software library, and even a rudimentary DOS, for the humble Arduino Uno . The library provides functions to allow low level work with floppy disks, to read them sector by sector. In addition it incorporates the FatFS library for MS-DOS FAT file-level access, and finally the  ArduDOS environment which allows browsing of files on a floppy. The pictures show a 3.5″ drive, but it also supports 5.25″ units and both DD and HD drives. We can see that it will be extremely useful to anyone working with retrocomputer software who...

With little more than four economical stepper motors, a Raspberry Pi Zero, and a 3D printer, [Thomas Barlow] made himself an awfully slick Smart Flip Clock that can display not only the time, but also weather data as well. This is done by adding a few extra graphics to some of the split-flaps, so numbers can also be used to indicate temperature and weather conditions succinctly. Displaying the time has to do without a colon (so 5:18 displays as 518 ), but being able to show temperature and weather conditions more than makes up for it. 32 degrees and a mix of sun and cloud According to the project’s GitHub repository , it looks as though each split-flap has thirteen unique positions. The first ten are for numerals 0 through 9, and the rest are either blank, or used to make up a few different weather icons with different combinations. A Python script runs on the Raspberry Pi and retrieves weather data from OpenWeather , and the GPIO header drives the display via four geared steppe...

Old CRT computer enthusiast [x86VileR] recently tracked down an IBM 5153 monitor for which he had been searching several years. Unfortunately shipping a heavy glass CRT isn’t easy. In fact, it took [VileR] three tries to get a functioning monitor delivered intact and working . The first one seemed reasonably protected in its packaging, but arrived so banged up that the CRT had become dislodged inside the monitor and the neck broke off! The second attempt was packaged even better, and he was sure it would arrive problem-free. Alas, it too arrived all banged up and broken. This one clearly had superior packaging, so I find it difficult to account for this truly stupendous level of damage. The most promising theory is that several people jumped on it simultaneously, just before the delivery truck ran it over. As my friend put it, it would’ve arrived in better shape if he had just smashed it himself before boxing it up. Double-boxing appears to be the answer, although it might result ...

Liquid fuelled engines are throttleable and monstrously powerful, but highly complex. Meanwhile, solid rocket engines are simple and cheap, but once you light them, they’re going full-bore until burnout. Hybrid rocket engines offer perks from both worlds, with simple solid fuel and the ability to throttle down by regulating oxidizer flow. Naturally, [Integza] decided he should try and 3D print one. The build came about somewhat by accident, as the 3D printed casing of one of [Integza’s] liquid-fuelled rockets continued burning once the fuel was turned off. This prompted the realization that he could 3D print rocket fuel, and simply supply oxygen, creating a hybrid rocket. Thus ensued much experimentation, going so far as to create custom sugar-loaded resin for more power and experimenting with ABS as a potential fuel. Most of the rockets self-destructed within a few seconds and thrust was minimal, but the basic concept should be a goer. As always, [Integza] is struggling with the th...

We’ve seen several so-called “digital dash” upgrades over the years that either augment, or completely replace, a vehicle’s original dashboard indicators with new displays. Whether its seven segment LEDs or a full-on graphical interface powered by the Raspberry Pi, the end result is the same: a dashboard that looks wildly different than it did when the car rolled off the assembly line. But this LED dashboard project from [Flyin’ Miata] takes a slightly different approach. Rather than replace the analog gauges entirely, rings of RGB LEDs of the same diameter were placed behind their matte black faces. When the LEDs are off you’d never notice them, but once they kick on, the light is clearly visible through the material. LEDs can easily shine through the gauge face. So far, it looks like most of the work seems to have been put into the tachometer. The firmware running on the CAN equipped Adafruit Feather M4 can do things such as light up a dynamic redline based on current engine t...

In theory, there’s isn’t much to building a CNC machine. Hook a bit to a motor and move the motor around with some lead screws and stepper motors. Easy. But, of course, the devil is in the details. [DAZ] made a nice-looking and inexpensive rig that probably isn’t the most precise CNC in the world, but it looks like it does a good enough job and he claims he spent about $50 on it. The video below shows some of the work it has done, and it doesn’t look bad. This isn’t a rainy afternoon project. You’ll need to cut some wood and 3D print many parts. The drives use M8 threaded rod. Electronics is just an Arduino running standard software. The steppers looked pretty light duty, and we wondered if it would have been worthwhile to trade them out for beefier ones instead of modifying the ones used for bipolar operation. Still, the results did look good for $50. The 775 spindle is another place you could probably spend a little more and get something better. Non-printed linear rails, and a b...

I’ve been playing with a few MicroPython projects recently on several different embedded platforms, including a couple of ESP32 WiFi modules. There are various ways to program these modules: Use a serial terminal and ampy (maintained by [devxpy] since being dropped by Adafruit in 2018). If you use Pycom boards or WiFy firmware, there are the pymakr plugins for Atom and Visual Studio . If you prefer the command-line like me, there is rshell by one of the top MicroPython contributors [Dave Hylands]. For over a year, I have been quite happy with rshell until I started working on these wireless nodes. Being lazy, I want to tinker with my ESP32 modules from the sofa, not drag my laptop into the kitchen or balcony to plug up a USB cable. Can’t I work with them wirelessly? Well, you can use WebREPL . While its functional, it just didn’t strike my fancy for some reason. [Elliot] mentioned in a recent podcast that he’s using telnet to access his wireless nodes, but he’s using esp-...

We wondered recently about those crude ASCII schematics you see in some documentation — are there any dedicated schematic-focused tools to draw them, or are they just hand-crafted using various ASCII-art drawing tools? To our surprise, there is such a tool. It is called AACircuit  and was developed by [Andreas Weber]. It has a history going back to 2001 when it was first introduced as ASCIIPaint. Be forewarned, however, the quality of the code may be questionable. According to the notes on [Andy]’s GitHub repository : WARNING: a lot of spaghetti code ahead This code was created in 2001-2004 when I taught Borland Delphi 3 to myself. It contains many, many global variables, unstructured and undocumented procedural code and bad variable names. If you don’t want to wrestle with old and sketchy object-oriented Pascal code, you’re in luck. [Chaos Ordered] has made a Pythonized version which you can get from his GitHub repository . We tried it out and got it working ...

from Packet Storm https://ift.tt/3u5NOR1

from Packet Storm https://ift.tt/3e1W4vW

from Packet Storm https://ift.tt/3vyOj6J

from Packet Storm https://ift.tt/3eF0qbr

Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility, grep. It's comparable to other static analysis applications like RATS, SWAAT, and flaw-finder while keeping the technical requirements to a minimum and being very flexible. from Packet Storm https://ift.tt/3t7tIVk

Ubuntu Security Notice 4929-1 - Greg Kuechle discovered that Bind incorrectly handled certain incremental zone updates. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. Siva Kakarla discovered that Bind incorrectly handled certain DNAME records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. It was discovered that Bind incorrectly handled GSSAPI security policy negotiation. A remote attacker could use this issue to cause Bind to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed. from Packet Storm https://ift.tt/2RduUsQ

Red Hat Security Advisory 2021-1468-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. from Packet Storm https://ift.tt/332mBD7

NodeBB Emoji plugin version 3.2.1 suffers from an arbitrary file write vulnerability. from Packet Storm https://ift.tt/3nwasQd

Ubuntu Security Notice 4928-1 - It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. Various other issues were also addressed. from Packet Storm https://ift.tt/32VULIG

Red Hat Security Advisory 2021-1452-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. The ceph-ansible package provides Ansible playbooks for installing, maintaining, and upgrading Red Hat Ceph Storage. Perf Tools is a collection of performance analysis tools, including a high performance multi-threaded malloc() implementation that works particularly well with threads and STL, a thread-friendly heap-checker, a heap profiler, and a cpu-profiler. from Packet Storm https://ift.tt/3e3JBYQ

Cacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability. from Packet Storm https://ift.tt/3ny2Ooj

Red Hat Security Advisory 2021-1448-01 - Red Hat Advanced Cluster Management for Kubernetes 2.0.10 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which resolve some security issues and bugs. Issues addressed include a code execution vulnerability. from Packet Storm https://ift.tt/3aMJs9U

Fog Project version 1.5.9 suffers from a remote shell upload vulnerability. from Packet Storm https://ift.tt/3t0lNJn

Ethiopia is in the midst of a major nation-building project, constructing the Grand Ethiopian Renaissance Dam (GERD). Upon completion, GERD will become the largest hydropower plant in Africa, providing much needed electricity for the country’s growing population. The project dams the Blue Nile, a river which later flows into neighbouring Sudan, where it merges with the White Nile and then flows on to Egypt. Like all rivers that flow across political boundaries, concerns have been raised about the equitable management of the water resources to the benefit of those upstream and down. Too much water dammed upstream in GERD could have negative effects on Egyptian agriculture reliant on river flows, for example. Efforts are ongoing to find a peaceful solution that suits all parties. Recently, suggestions have been made to supplement the dam’s power output with solar and wind to minimise disruption to the river’s users . A Delicate Balance A map showing the various rivers that combine ...

Buying a set of stylish bookshelf speakers is a perfectly reasonable thing to do, and remains legal in most free countries around the world. However, if you really want to impress with a pretty pair to crank out your tunes, you might consider designing and printing your own. [EH_Design] did just that with a stylish 2.1 Bluetooth audio system. The 2.1 designation refers to the use of two stereo channels plus a subwoofer. It’s a popular setup as human perception means it’s not as necessary to have stereo imaging for low frequency content. The build uses a Texas Instruments TPA3116D2 Class D amplifier with a Bluetooth input, with the efficient design allowing the build to be more compact without the need for as much heat sinking. A 24 V supply delivering up to 3 A is specified, providing plenty of volume when needed. The speakers themselves consist of 3″ drivers mounted in attractive 3D-printed shells, with the “subwoofer” consisting of a pair of 5″ woofers paired up in a special isobar...

Ekranoplans are a curious class of vehicle; most well known for several Soviet craft designed to operate at sea, flying just above the waves in ground effect. [rctestflight] had accidentally come across the ground effect flight regime himself years ago, and decided it was time to build an ekranoplan of his own. I want to see little ekranoplans in at least three top 10 pop film clips by summer’s end. Please and thank you. While ground-effect flight can be quite stable for a heavy, human-scale craft, the smaller RC version suffered more from minor perturbations from the wind and such. Thus, a Pixracer autopilot was installed, and combined with a small LIDAR device to accurately measure altitude above the ground. With some custom tweaks to the Ardupilot firmware, the craft was able to cleanly fly along barely a foot off the ground. The final effect is almost mesmerizing; it appears as if the craft is hovering via some heretofore unknown technology rather than just flying in the usua...