Ever wanted to sniff USB device communications? The usual path was buying an expensive metal box with USB connectors, using logic analyzers, or wiring devboards together and hacking some software to make them forward USB data.

Now, thanks to [ataradov]’s work, you can simply use a Pi Pico – you only need to tap the D+ and D- pins, wire them to RP2040’s GPIOs, and you can sniff communication between your computer and any low-speed (1.1 Mbps) or full-speed (12 Mbps) devices. On the RP2040 side, plug the Pico into your computer, open the virtual serial port created, and witness the USB packets streaming in – for the price of a Pico, you get an elegant USB sniffer, only a little soldering required.

[ataradov] also offers us a complete board design with a RP2040 and a USB hub on it, equipped with USB sockets that completely free us from the soldering requirement; it’s an open-source KiCad design, so you can simply order some sniffers made from your favourite fab! This project is a great learning tool, it’s as cheap and easy to make as humanly possible, and it has big potential for things like reverse-engineering old and new systems alike. Just couple this hack with another Pico doing USB device or host duty, maybe get up to date with USB reverse-engineering fundamentals, and you could make a Facedancer-like tool with ease.

Need to reach 480 Mbit/s? [ataradov] has a wonderful board for you as well, that we have covered last year – it’s well worth it if a device of yours can only do the highest speed USB2 can offer, and, it offers WireShark support. Want WireShark support and to use a Pico? Here’s a GitHub project by another hacker, [tana]. By now, merely having a Pi Pico gives you so many tools, it’s not even funny.

We thank [Julianna] for sharing this with us!

With a number of repair-friendly companies entering the scene, we have gained motivation to dig deeper into devices they build, repurpose them in ways yet unseen, and uncover their secrets. One such secret was recently discovered by [Ayeitsyaboii] on Reddit – turns out, you can use the Steam Deck mainboard as a standalone CPU board for your device, no other parts required aside from cooling.

All you need is a USB-C dock with charging input and USB/video outputs, and you’re set – it doesn’t even need a battery plugged in. In essence, a Steam Deck motherboard is a small computer module with a Ryzen CPU and a hefty GPU! Add a battery if you want it to work in UPS mode, put an SSD or even an external GPU into the M.2 port, attach WiFi antennas for wireless connectivity – there’s a wide range of projects you can build.

Each such finding brings us closer to the future of purple neon lights, where hackers spend their evenings rearranging off-the-shelf devices into gadgets yet unseen. Of course, there’s companies that explicitly want us to hack their devices in such a manner – it’s a bet that Framework made to gain a strong foothold in the hacker community, for instance. This degree of openness is becoming a welcome trend, and it feels like we’re only starting to explore everything we can build – for now, if your Framework’s or SteamDeck’s screen breaks, you always have the option to build something cool with it.

[Via Dexerto]

Before today, we probably would have said that scratch-built relay computers were the sole domain of only the most wizardly of graybeards. But this impressive build sent in by [Will Dana] shows that not only are there young hardware hackers out there that are still bold enough to leave the transistor behind, but that they can help communicate how core computing concepts can be implemented with a bungle of wires and switches.

Created for his YouTube channel WillsBuilds, every component of this computer was built by [Will] himself. Each of the nine relay-packed protoboards inside the machine took hours to solder, and when that was done, he went out to the garage to start cutting the wood that would become the cabinet they all get mounted in.

The entire build process is documented in the video, and is interwoven with short segments that go deeper into the various concepts at play. If you’ve never been able to figure out how a box full of relays can add numbers together, this might be the video that finally makes it click for you (no pun intended).

We were particularly impressed with [Will]’s determination to not let any modern technology sneak into his build. When researching other relay builds, he found that some of them relied on anachronistic components like the 555 timer or quartz crystals to generate the clock signal. That simply wouldn’t do, so he initially tried to put together a variation of the clock circuit that [Paul Law] used in his gorgeous relay computer. In the end he couldn’t quite get it working the way he wanted, so he went really old school and came up with a clock module that uses a motorized cam and microswitch to generate the necessary pulses.

In the era of the 10 cent microcontroller, when it’s often easier to write a few lines of code to get something working than figuring out how to do it with discrete components, this project is certainly refreshing. Especially when it’s coming from a younger maker. [Will] definitely came away from this build with several new skills under his belt and a new appreciation for concepts that many of us take for granted these days, and we’re looking forward to seeing what he comes up with next.

youtube.com/embed/KP4FK6AMIoc?…

Many smart electric meters in the US use the 900 MHz band to broadcast their usage out to meter readers as they walk the neighborhood. [Jeff Sandberg] used an RTL-SDR dongle and some software to integrate this data into his own home automation system, which lets him keep track of his home’s power usage.

Half of the comment section was appalled that the meters broadcast this data in the clear, and these readers thought this data should be encrypted even if the reach is limited to the home-owner’s front yard. But that would have stopped [Jeff] from accessing his own data as well, and that would be a shame. So there’s clearly a tradeoff in play here.

We see this tradeoff in a lot of hardware devices as well – we want to be able to run our firmware on them, but we don’t want criminals to do the same. We want the smart device to work with the cloud service, but to also work with our own home automation system if we have one. And we want to be able to listen in to our smart meters, but don’t necessarily want others to do so.

The solution here is as easy as it is implausible that it will get implemented. If the smart meters transmitted encrypted, each with their own individual password, then everyone would win. The meter reader would have a database of passwords linked to meter serial numbers or addresses, and the home owner could just read it off of a sticker, optimally placed on each unit. Privacy and usability would be preserved.

This issue isn’t just limited to electric meters. Indeed, think of all of the data that is being sent out from or about you, and what percentage of it is not encrypted and should be, but also about what data is sent out encrypted that you could use access to. The solution is to put you in control of the encryption, by selecting a password or having access to one that’s set for you. Because after all, if it’s your data, it should be your data: private and usable.

This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter. Want this type of article to hit your inbox every Friday morning? You should sign up!

Alpha Team è un gruppo di hacker criminali che abbiano incontrato in passato. Spesso li abbiamo visti colpire con efficacia le aziende italiane. Abbiano anche conosciuto più da vicino il gruppo attraverso l’intervista al loro leader Z0rg.

Questa volta il gruppo ha rilevato un altro bug di sicurezza non documentato (0day) che affligge diverse piattaforme di Content Management System (CMS). Attraverso questo bug hanno iniziato ad utilizzarlo per rendere pubblica la falla di sicurezza individuata.

Su alcuni social sono iniziate a circolare delle print screen che riportano la violazione di alcune APP/backend con specifiche notifiche push.

La rivendicazione di Alpha Team

All’interno del noto forum underground Breach forum, Alpha Team ha pubblicato un post dove riporta una serie di aziende che utilizzano questa tecnologia CMS che è risultata essere affetta da tale bug di sicurezza.

Si parla di moltissime testate giornalistiche che utilizzano un preciso CMS su Cloud.

Alpha team ha riportato che ha a disposizione il database di 77 aziende e tra i dati disponibili sono presenti email, password, date di nascita e altro ancora.

Per attestare che i dati sottratti sono effettivamente reali, la cyber gang riporta all’interno del post dei samples che possono essere scaricati per verificarne la violazione.

Il gruppo Alpha Team

Il gruppo Alpha Team ha violato in precedenza diversi obiettivi italiani. Ricordiamo che Alpha Team ha violato in passato 10 organizzazioni italiane sempre con un bug di sicurezza non documentato. Successivamente ha rivendicato un attacco informatico alla Avantgate e a Federprivacy.

L'articolo ALPHA TEAM ha in mano 5 milioni di dati di italiani! Rivendica un attacco a 77 Aziende italiane proviene da il blog della sicurezza informatica.