Hackaday Editors Elliot Williams and Al Williams met up to cover the best of Hackaday this week, and they want you to listen in. There were a hodgepodge of hacks this week, ranging from home automation with RF, volumetric displays in glass, and some crazy clocks, too.

Ever see a typewriter that uses an ink pen? Elliot and Al hadn’t either. Want time on a supercomputer? It isn’t free, but it is pretty cheap these days. Finally, the guys discussed how to focus on a project like Dan Maloney, who finally got a 3D printer, and talked about Maya Posch’s take on LLM intelligence.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

html5-player.libsyn.com/embed/…

Download the human-generated podcast in mostly mono, but sometimes stereo, MP3.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

• iTunes
• Spotify
• Stitcher
• RSS
• YouTube
• Check out our Libsyn landing page

Episode 349 Show Notes:

News:

• Failed 3D Printed Part Brings Down Small Plane

What’s that Sound?

• What is that sound? Al didn’t guess, but if you can, you could win a coveted Hackaday Podcast T-Shirt.

Interesting Hacks of the Week:

• Bridging RTL-433 To Home Assistant
  
  • GitHub – merbanan/rtl_433: Program to decode radio transmissions from devices on the ISM bands (and other frequencies)

  
  

• The Key To Plotting
• Reverse Sundial Still Tells Time
• Trace Line Clock Does It With Magnets
• Volumetric Display With Lasers And Bubbly Glass
  
  • Wiremap, A Volumetric Display

  
  

• The Engineering That Makes A Road Cat’s Eye Self-Cleaning

Quick Hacks:

• Elliot’s Picks:
  
  • Production KiCad Template Covers All Your Bases
  • RP2350 Done Framework Style
    
    • github.com/semitov/SemiTOV-MCL

    
    

  • Neat Techniques To Make Interactive Light Sculptures

  
  

• Al’s Picks:
  
  • Super Simple Deadbuggable Bluetooth Chip
  • LED Hourglass Is A Great Learning Project
  • Your Supercomputer Arrives In The Cloud

  
  

Can’t Miss Articles:

• Ask Hackaday: Solutions, Or Distractions?
• Why LLMs Are Less Intelligent Than Crows
  
  • What Is ChatGPT Doing … and Why Does It Work?

  
  

hackaday.com/2025/12/12/hackad…

Una presunta banca dati contenente informazioni sensibili su 18 milioni di cittadini statunitensi over 65 è apparsa in vendita su un noto forum del dark web.

L’inserzionista, che usa lo pseudonimo “Frenshyny”, sostiene di aver sottratto i dati direttamente dal portale governativo irs.gov, che gestisce, tra le altre cose, documentazione fiscale e informazioni sui piani pensionistici 401(k).

Disclaimer: Questo rapporto include screenshot e/o testo tratti da fonti pubblicamente accessibili. Le informazioni fornite hanno esclusivamente finalità di intelligence sulle minacce e di sensibilizzazione sui rischi di cybersecurity. Red Hot Cyber condanna qualsiasi accesso non autorizzato, diffusione impropria o utilizzo illecito di tali dati. Al momento, non è possibile verificare in modo indipendente l’autenticità delle informazioni riportate, poiché l’organizzazione coinvolta non ha ancora rilasciato un comunicato ufficiale sul proprio sito web. Di conseguenza, questo articolo deve essere considerato esclusivamente a scopo informativo e di intelligence.

Cosa conterrebbe il database

L’annuncio elenca una quantità impressionante di dati personali, indicati come:

• Nome e cognome
• Età
• Stato e città
• Indirizzo
• Codice postale
• Numero di telefono
• Email

Si tratterebbe, secondo il venditore, di informazioni relative ai beneficiari dei 401(k) Benefit Funds, il celebre piano di risparmio previdenziale statunitense attivo dagli anni ’80.

La quantità – 18 milioni di record – suggerisce una compromissione estremamente ampia, che se confermata implicherebbe il più grande data breach mai registrato sul sistema pensionistico privato statunitense.

Il contesto del forum

L’annuncio è pubblicato in una sezione dedicata alla vendita di database rubati. Il venditore si presenta come membro “V.I.P.” del forum, sottolineando una certa reputazione nella community e offrendo la possibilità di contattarlo su Telegram per “prove e prezzi”.

Il post contiene inoltre una lunga descrizione del funzionamento dei piani 401(k), probabilmente inserita per rendere più credibile la provenienza dei dati.

Perché questo leak sarebbe estremamente pericoloso

Se autentico, un database di tale portata esporrebbe milioni di cittadini anziani a:

• Frodi finanziarie su larga scala, incluse truffe relative alla previdenza.
• Furti d’identità, grazie al pacchetto completo di informazioni personali.
• Attacchi di social engineering mirati, particolarmente efficaci su persone più vulnerabili.
• Accesso fraudolento a conti o servizi collegati ai piani pensionistici.

Gli over 65 sono tra i bersagli preferiti dei criminali informatici, e possedere dati verificati li rende estremamente appetibili per campagne fraudolente.

Un nuovo segnale del boom del cyber-crimine finanziario

L’apparizione di questo presunto database conferma una tendenza ormai consolidata: il settore finanziario e previdenziale è diventato uno dei principali target per i threat actors.

Dati come quelli contenuti nei registri pensionistici, infatti, hanno un valore particolarmente alto nei mercati clandestini.

Se verificata, questa vendita rappresenterebbe l’ennesimo colpo alla sicurezza dei sistemi governativi statunitensi e un rischio enorme per milioni di pensionati.

L'articolo Banca dati IRS con 18 milioni di record 401(k) in vendita nel dark web proviene da Red Hot Cyber.

The Landel Mailbug was a weird little thing. It combined a keyboard and a simple text display, and was intended to be a low-distraction method for checking your email. [CiferTech] decided to repurpose it, though, turning it into an AI console instead.

The first job was to crack the device open and figure out how to interface with the keyboard. The design was conventional, so reading the rows and columns of the key matrix was a cinch. [CiferTech] used PCF8574 IO expanders to make it easy to read the matrix with an ESP32 microcontroller over I2C. The ESP32 is paired with a small audio output module to allow it to run a text-to-speech system, and a character display to replace the original from the Mailbug itself. It uses its WiFi connection to query the ChatGPT API. Thus, when the user enters a query, the ESP32 runs it by ChatGPT, and then displays the output on the screen while also speaking it aloud.

[CiferTech] notes the build was inspired by AI terminals in retro movies, though we’re not sure what specifically it might be referencing. In any case, it does look retro and it does let you speak to a computer being, of a sort, so the job has been done. Overall, though, the build shows that you can build something clean and functional just by reusing and interfacing a well-built commercial product.

youtube.com/embed/pRIfY21PpyI?…

hackaday.com/2025/12/12/weird-…

Amnesty International ha attivato un proprio sito accessibile tramite dominio .onion sulla rete Tor, offrendo così un nuovo canale sicuro per consultare informazioni e ricerche dell’organizzazione. L’iniziativa, lanciata ufficialmente nel dicembre 2023, nasce dall’esigenza di garantire accesso ai contenuti anche in quei Paesi dove il sito principale viene oscurato o pesantemente monitorato.

La decisione arriva in un contesto globale segnato da crescenti restrizioni digitali. In Stati come Russia, Iran e Cina, l’intero portale di Amnesty International risulta bloccato, impedendo ai cittadini di informarsi liberamente sulle violazioni dei diritti umani. In diverse altre regioni, invece, la navigazione è esposta a sorveglianza governativa, con rischi diretti per attivisti, giornalisti e dissidenti.

Tor, acronimo di The Onion Router, rappresenta uno strumento fondamentale per aggirare queste limitazioni. La rete utilizza una serie di relay gestiti da volontari e applica più livelli di crittografia, rendendo estremamente difficile risalire all’indirizzo IP dell’utente. Questo sistema consente un livello di anonimato più elevato rispetto alla navigazione tradizionale.

Nei browser comuni, l’accesso a un sito avviene tramite DNS e connessioni dirette al server, un processo che espone gli utenti al tracciamento del loro indirizzo IP. Questo elemento, paragonabile all’indirizzo di ritorno di una lettera postale, può essere utilizzato per mappare le attività digitali di una persona senza che ne abbia consapevolezza.

Il browser Tor, invece, inoltra i dati attraverso una catena di nodi distribuiti, mascherando la vera origine del traffico. Quando si accede a un dominio .onion, la comunicazione non abbandona mai la rete Tor e beneficia di una crittografia end-to-end, riducendo ulteriormente i rischi di intercettazione o identificazione.

Amnesty International ha scelto questa infrastruttura proprio per proteggere gli utenti che consultano materiali sensibili relativi a denunce, indagini e campagne sui diritti umani. L’obiettivo è permettere l’accesso a informazioni indipendenti anche in contesti autoritari, senza che chi naviga sia costretto a esporre la propria identità digitale.

La necessità di strumenti come Tor è emersa in modo ancora più evidente dopo indagini come il Project Pegasus del 2021, in cui Amnesty ha documentato l’uso dello spyware della società NSO Group per monitorare fino a 50.000 dispositivi mobili. Tecnologie di questo tipo, utilizzate da governi di varie nazionalità, hanno colpito attivisti, avvocati, giornalisti e oppositori politici.

In un’epoca segnata da sorveglianza avanzata e censura mirata, l’apertura del sito .onion di Amnesty International si inserisce in una più ampia strategia di difesa della libertà digitale. Fornire accesso sicuro ai contenuti è un passo concreto per permettere alle persone di informarsi senza mettere a rischio la propria privacy o la propria sicurezza personale.

L'articolo Amnesty sbarca nel Dark Web: ecco perché ha aperto il suo sito .onion proviene da Red Hot Cyber.

Microsoft has published a patch-set for the Linux kernel, proposing the Hornet Linux Security Module (LSM). If you haven’t been keeping up with the kernel contributor scoreboard, Microsoft is #11 at time of writing and that might surprise you. The reality is that Microsoft’s biggest source of revenue is their cloud offering, and Azure is over half Linux, so Microsoft really is incentivized to make Linux better.

The Hornet LSM is all about more secure eBPF programs, which requires another aside: What is eBPF? First implemented in the Berkeley Packet Filter, it’s a virtual machine in the kernel, that allows executing programs in kernel space. It was quickly realized that this ability to run a script in kernel space was useful for far more than just filtering packets, and the extended Berkeley Packet Filter was born. eBPF is now used for load balancing, system auditing, security and intrusion detection, and lots more.

This unique ability to load scripts from user space into kernel space has made eBPF useful for malware and spyware applications, too. There is already a signature scheme to restrict eBPF programs, but Hornet allows for stricter checks and auditing. The patch is considered a Request For Comments (RFC), and points out that this existing protection may be subject to Time Of Check / Time Of Use (TOCTOU) attacks. It remains to be seen whether Hornet passes muster and lands in the upstream kernel.

Patch Tuesday

Linux obviously isn’t the only ongoing concern for Microsoft, and it’s the time of month to talk about patch Tuesday. There are 57 fixes that are considered vulnerabilities, and additional changes that are just classified internally as bug fixes. There were three of those vulnerabilities that were publicly known before the fix, and one of those was known to be actively used in attacks in the wild.

CVE-2025-62221 was an escalation of privilege flaw in the Windows Cloud Files Mini Filter Driver. In Windows, a minifilter is a kernel driver that attach to the file system software, to monitor or modify file operations. This flaw was a use-after-free that allowed a lesser-privileged attacker to gain SYSTEM privileges.

Gogs

Researchers at Wiz found an active exploitation campaign that uses CVE-2025-8110, a previously unknown vulnerability in Gogs. The GO Git Service, hence the name, is a self-hosted GitHub/GitLab alternative written in Go. It’s reasonably popular, with 1,400 of them exposed to the Internet.

The vulnerability was a bypass of CVE-2024-55947, a path traversal vulnerability that allowed a malicious user to upload files to arbitrary locations. That was fixed with Gogs 0.13.1, but the fix failed to account for symbolic links (symlinks). Namely, as far as the git protocol is concerned, symlinks are completely legal. The path traversal checking doesn’t check for symlinks during normal git access, so a symlink pointing outside the repository can easily be created. And then the HTTPS file API can be used to upload a file to that symlink, again allowing for arbitrary writes.

The active exploitation on this vulnerability is particularly widespread. Of the 1400 Gogs instances on the Internet, over 700 show signs of compromise, in the form of new repositories with randomized names. It’s possible that even more instances have been compromised, and the signs have been covered. The attack added a symlink to .git/config, and then overwriting that file with a new config that defines the sshCommand setting. After exploitation, a Supershell malware was installed, establishing ongoing remote control.

The most troubling element of this story is that the vulnerability was first discovered in the wild back in July and was reported to the Gogs project at that time. As of December 11, the vulnerability has not been fixed or acknowledged. After five months of exploitation without a patch, it seems time to acknowledge that Gogs is effectively unmaintained. There are a couple of active forks that don’t seem to be vulnerable to this attack; time to migrate.

Blinkenlights

There’s an old story I always considered apocryphal, that data could be extracted from the blinking lights of network equipment, leading to a few ISPs to boast that they covered all their LEDs with tape for security. While there may have been a bit of truth to that idea, it definitely served as inspiration for [Damien Cauquil] at Quarkslab, reverse engineering a very cheap smart watch.

The watches were €11.99 last Christmas, and a price point that cheap tickles the curiosity of nearly any hacker. What’s on the inside? What does the firmware look like? The micro-controller was by the JieLi brand, and it’s a bit obscure, with no good way to pull the firmware back off. With no leads there, [Damien] turned to the Android app and the Bluetooth Low Energy connection. One of the functions of the app is uploading custom watch dials. Which of course had to be tested by creating a custom watch face featuring a certain Rick Astley.

But those custom watch faces have a quirk. The format internally uses byte offsets, and the watch doesn’t check for that offset to be out of bounds. A ridiculous scheme was concocted to abuse this memory leak to push firmware bytes out as pixel data. It took a Raspberry Pi Pico sniffing the SPI bus to actually recover those bytes, but it worked! Quite the epic hack.

Bits and Bytes

Libpng has an out of bounds read vulnerability, that was just fixed in 1.6.52. What’s weird about this one is that the vulnerability is can be triggered by completely legitimate PNG images. The good news is that is vulnerability only effects the simplified API, so not every user of libpng is in the blast radius.

And finally, Google has pushed out an out-of-band update to Chrome, fixing a vulnerability that is being exploited in the wild. The Hacker News managed to connect the bug ID to a pull request in the LibANGLE library, a translation layer between OpenGL US calls into Direct3D, Vulkan, and Metal. The details there suggests the flaw is limited to the macOS platform, as the fix is in the metal renderer. Regardless, time to update!

hackaday.com/2025/12/12/this-w…

12 dicembre, Piazza Fontana, strage di stato: non dimentichiamo
differx.noblogs.org/2025/12/12…

#piazzafontana #stragidistato #ordinenuovo #stragifasciste #stragedistato

From national outlets to college newspapers, reporters are running into the same troubling trend: sources who are afraid to speak to journalists because they worry about retaliation from the federal government.

This fear, and how journalists can respond to it, was the focus of a recent panel discussion hosted by Freedom of the Press Foundation (FPF), the Association of Health Care Journalists, and the Society of Environmental Journalists. Reporters from a range of beats described how the second Trump administration has changed the way people talk to the press, and what journalists do to reassure sources and keep them safe.

youtube.com/embed/rIyRDQFEl4k?…

For journalist Grace Hussain, a solutions correspondent at Sentient Media, this shift became unmistakable when sources who relied on federal funding suddenly backed out of participating in her reporting. “Their concerns were very legitimate,” Hussain said, “It was possible that their funding could get retracted or withdrawn” for speaking to the press.

When Hussain reached out to other reporters, she found that sources’ reluctance to speak to the press for fear of federal retaliation is an increasingly widespread issue that’s already harming news coverage. “There are a lot of stories that are under-covered, and it’s just getting more difficult at this point to do that sort of coverage with the climate that we’re in,” she said.

Lizzy Lawrence, who covers the Food and Drug Administration for Stat, has seen a different but equally unsettling pattern. Lawrence has found that more government sources want to talk about what’s happening in their agencies, but often only if they’re not named. Since Trump returned to office, she said, many sources “would request only to speak on the condition of anonymity, because of fears of being fired.” As a result, her newsroom is relying more on confidential sources, with strict guardrails, like requiring multiple sources to corroborate information.

For ProPublica reporter Sharon Lerner, who’s covered health and the environment across multiple administrations, the heightened fear is impossible to miss. Some longtime sources have cut off communication with her, including one who told her they were falsely suspected of leaking.

And yet, she added, speaking to the press may be one of the last options left for employees trying to expose wrongdoing. “So many of the avenues for federal employees to seek justice or address retaliation have been shut down,” Lerner said.

This chilling effect extends beyond federal agencies. Emily Spatz, editor-in-chief of Northeastern’s independent student newspaper The Huntington News, described how fear spread among international students after federal agents detained Mahmoud Kahlil and Rümeysa Öztürk. Visa revocations of students at Northeastern only deepened the concern.

Students started asking the newspaper to take down previously published op-eds they worried could put them at risk, a step Spatz took after careful consideration. The newsroom ultimately removed six op-eds but posted a public website documenting each removal to preserve transparency.

Even as the paper worked hard to protect sources, many became reluctant to participate in their reporting. One student, for instance, insisted the newspaper remove a photo showing the back of their head, a method the paper had used specifically to avoid identifying sources.

Harlo Holmes, the chief information security officer and director of digital security at FPF, said these patterns mirror what journalists usually experience under authoritarian regimes, but — until now — have not been seen in the United States. Whistleblowing is a “humongously heroic act,” Holmes said, “and it is not always without its repercussions.”

She urged reporters to adopt rigorous threat-modeling practices and to be transparent with sources about the tools and techniques they use to keep them safe. Whether using SecureDrop, Signal, or other encrypted channels, she said journalists should make it easy for sources to find out how to contact them securely. “A little bit of education goes a long way,” she said.

For more on how journalists are working harder than ever to protect vulnerable sources, watch the full event recording here.

freedom.press/issues/journalis…

As the federal government ramps up immigration enforcement, sweeping through cities, detaining citizens and noncitizens, separating families, and carrying out deportations, journalists covering immigration have had to step up their work, too.

Journalists on the immigration beat today are tasked with everything from uncovering government falsehoods to figuring out what their communities need to know and protecting their sources. Recently, Freedom of the Press Foundation (FPF) hosted a conversation with journalists Maritza Félix, the founder and director of Conecta Arizona; Arelis Hernández, a reporter for The Washington Post; and Lam Thuy Vo, an investigative reporter with Documented. They discussed the challenges they face and shared how they report on immigration with humanity and accuracy, while keeping their sources and themselves safe.

youtube.com/embed/OPPo0YzKfnA?…

Immigration reporting has grown a lot more difficult, explained Hernández, as sources increasingly fear retaliation from the government. “I spend a lot of time at the front end explaining, ‘Where will this go? What will it look like?’” Hernández said, describing her process of working with sources to ensure they participate in reporting knowingly and safely. She also outlined her own precautions, from using encrypted devices to carrying protective gear, highlighting just how unsafe conditions have become, even for U.S.-born reporters.

Like Hernández, Félix also emphasized the intense fear and uncertainty many immigrant sources experience. Other sources, however, may be unaware of the possible consequences of speaking to reporters and need to be protected as well. “I think when we’re talking about sources, particularly with immigration, we’re talking about people who are sharing their most vulnerable moments in their life, and I think the way that we treat it is going to be very decisive on their future,” she said.

Journalists who are themselves immigrants must also manage personal risk, Félix said, “but the risk is always going to be there just because of who we are and what we represent in this country.” She pointed to the arrest and deportation of journalist Mario Guevara in Georgia, saying it “made me think that could have been me” before she became a U.S. citizen. She recommended that newsrooms provide security training, mental health resources, and operational protocols for both staff and freelancers.

Both Félix and Vo, who work in newsrooms by and for immigrant communities, emphasized the need for journalists to actively listen to the people they cover. “If you’re trying to serve immigrants, build a listening mechanism, some kind of way of continuing to listen to both leaders in the community, service providers, but also community members,” Vo advised. She also recommended that journalists use risk assessments and threat modeling to plan how to protect themselves and their sources.

Watch the full discussion here.

freedom.press/issues/covering-…

March Sunday / Leonora Carrington. 1990
differx.noblogs.org/2025/12/10…

#leonoracarrington