È stata scoperta e una vulnerabilità nell’archiviatore 7-Zip che poteva aggirare la funzionalità di sicurezza Mark of the Web (MotW) in Windows ed eseguire codice sul computer della vittima.

Il supporto MotW è arrivato a 7-Zip nel giugno 2022, a partire dalla versione 22.00. Da allora, i MotW sono stati assegnati a tutti i file estratti dagli archivi scaricati. Questi flag informano il sistema operativo, i browser e altre applicazioni che i file potrebbero provenire da fonti non attendibili e devono essere trattati con cautela.

Di conseguenza, quando fanno doppio clic sui file estratti utilizzando 7-Zip, gli utenti dovrebbero visualizzare un avviso che informa che l’apertura o l’esecuzione dei file potrebbe comportare azioni potenzialmente pericolose, inclusa l’installazione di malware.

Inoltre, Microsoft Office risponderà al MotW e aprirà tali documenti in modalità Visualizzazione protetta, ovvero in modalità di sola lettura, con le macro disabilitate. Secondo i ricercatori di Trend Micro, una vulnerabilità 7-Zip scoperta di recente (CVE-2025-0411) la quale ha consentito agli aggressori di aggirare questi avvisi ed eseguire codice dannoso sui computer delle vittime.

“La vulnerabilità consente agli aggressori remoti di aggirare il meccanismo di protezione Mark-of-the-Web nelle versioni vulnerabili di 7-Zip. Lo sfruttamento del problema richiede l’intervento dell’utente per visitare una pagina dannosa o aprire un file dannoso, scrivono i ricercatori. — Lo svantaggio è legato all’elaborazione dei file di archivio. Quando si estraggono file da un archivio MotW, 7-Zip non applica i contrassegni MotW ai file estratti. Un utente malintenzionato potrebbe sfruttare questo problema per eseguire codice arbitrario nel contesto dell’utente corrente.”

Lo sviluppatore di 7-Zip Igor Pavlov ha risolto questa vulnerabilità il 30 novembre 2024, rilasciando la versione 7-Zip 24.09. “Il file manager 7-Zip non propagava il flusso Zone.Identifier ai file estratti dagli archivi nidificati”, ha spiegato Pavlov .

Poiché 7-Zip non dispone di una funzione di aggiornamento automatico, si consiglia agli utenti di aggiornare manualmente l’archiviatore a una versione sicura il prima possibile.

L'articolo 7-Zip 24.09: Risolta la falla che permetteva l’esecuzione di codice malevolo proviene da il blog della sicurezza informatica.

Last year we covered the creation of a 3D-printed full-size replica of an original Computer Space arcade machine, the legendary first glimmer from what would become Atari, one of the most famous names in gaming. The flowing exuberance of glitter-finished fibreglass made these machines instantly recognisable. Not so well known though is that there was a second cabinet in a similar vein from Atari. Space Race is most often seen in a conventional wooden cabinet, but there were a limited number of early examples made in an asymetric angular take on the same fibreglass recipe as Computer Space. They’re super rare, but that hasn’t stopped a replica being made by the same team and documented in a pair of videos by [RMC – The Cave].

Just like the earlier project, a start was made with a 3D model. In this case an owner of a real cabinet was found, who ran off a not-very-good scan with a mobile phone. THis was then used as the basis for a much better model, and the various pieces were printed. Using all manner of reel ends gave the assembled cabinet a coat of many colours look, but after a coat of filler, paint, and then glitter lacquer, you would never know. Electronics come courtesy of modern emulation hardware and a Sony CCTV monitor, and the joysticks were made from a mixture of common hardware and 3D prints Both the videos are below the break, and you’ll now no doubt also want to see the original project..

youtube.com/embed/SONO6LTHuR8?…

youtube.com/embed/aqbQw1s9LOo?…

hackaday.com/2025/01/23/a-seco…

In the olden days of the WWW you could just put a robots.txt file in the root of your website and crawling bots from search engines and kin would (generally) respect the rules in it. These days, however, we have especially web crawlers from large language model (LLM) companies happily ignoring such signs on the lawn before proceeding to hover up every scrap of content on websites. Naturally this makes a lot of people very angry, but what can you do about it? The answer by [Aaron B] is Nepenthes, described on the project page as a ‘tar pit for catching web crawlers’.

More commonly known as ‘pitcher plants’, nepenthes is a genus of carnivorous plants that use a fluid-filled cup to trap insects and small critters unfortunate enough to slip & slide down into it. In the case of this Lua-based project the idea is roughly the same. Configured as a trap behind a web server (e.g. /nepenthes), any web crawler that accesses it will be presented with an endless number of (randomly generated) pages with many URLs to follow. Page generating is deliberately quite slow to not soak up significant CPU time, while still giving the LLM scrapers plenty of random nonsense to chew on.

Considering that these web crawlers deemed adhering to the friendly sign on the lawn beneath them, the least we can do in response, is to hasten model collapse by feeding these LLM scrapers whatever rolls out of a simple (optionally Markov-based) text generator.

hackaday.com/2025/01/23/trap-n…

Last October we showed you a video from [LiamTronix], in which he applied an electric conversion to a 1960s Massey-Ferguson 65 which had seen better days. It certainly seemed ready for light work around the farm, but it’s only now that we get his video showing the machine at work. This thing really can farm!

An MF 65 wasn’t the smallest of 1960s tractors, but by today’s standards it’s not a machine you would expect to see working a thousand acres of wheat. Instead it’s a typical size for a smaller operation, perhaps a mixed farm, a small livestock farm, or in this case a horticulture operation growing pumpkins. In these farms the tractor doesn’t often trail up and down a field for hours, instead it’s used for individual smaller tasks where its carrying or lifting capacity is needed, or for smaller implements. It’s in these applications that we see the electric 65 being tested, as well as some harder work such as hauling a trailer load of bales, or even harrowing a field.

In one sense the video isn’t a hack in itself, for that you need to look at the original build. But it’s important to see how a hack turned out in practice, and this relatively straightforward conversion with a DC motor has we think proven itself to be more than capable of small farm tasks. Its only flaw in the video is a 30 minute running time, something he says he’ll be working on by giving it a larger battery pack. We’d use it on the Hackaday ancestral acres, any time!

The video is below the break.

youtube.com/embed/6tH0DZVYvVY?…

hackaday.com/2025/01/23/an-ele…

QR codes are designed with alignment and scaling features, not to mention checksums and significant redundancy. They have to be, because you’re taking photos of them with your potato-camera while moving, in the dark, and it’s on a curved sticker on a phone pole. So it came as a complete surprise to us that [Christian Walther] succeeded in making an ambiguous QR code.

Nerd-sniped by [Guy Dupont], who made them using those lenticular lens overlays, [Christian] made a QR code that resolves to two websites depending on the angle at which it’s viewed. The trick is to identify the cells that are different between the two URLs, for instance, and split them in half vertically and horizontally: making them into a tiny checkerboard. It appears that some QR decoders sample in the center of each target square, and the center will be in one side or the other depending on the tilt of the QR code.

Figuring out the minimal-difference QR code encoding between two arbitrary URLs would make a neat programming exercise. How long before we see these in popular use, like back in the old days when embedding images was fresh? QR codes are fun!

Whether it works is probably phone- and/or algorithm-dependent, so try this out, and let us know in the comments if they work for you.

Thanks [Lacey] for the tip!

hackaday.com/2025/01/23/this-q…

With ready availability of single board computers, displays, keyboards, power packs, and other hardware, a home-made laptop is now a project within most people’s reach. Some laptop projects definitely veer towards being cyberdecks while others take a more conventional path, but we’ve rarely seen one as professional looking as [Byran Huang]’s anyon_e open source laptop. It really takes the art to the next level.

The quality is immediately apparent in the custom CNC-machined anodised aluminium case, and upon opening it up the curious user could be forgiven for thinking they had a stylish commercial machine in their hands. There’s a slimline mechanical keyboard and a glass trackpad, and that display is an OLED. In fact the whole thing had been built from scratch, and inside is an RK3588 SoC on a module sitting on a custom-designed motherboard. It required some effort for it to drive the display, a process we’ve seen cause pain to other designers, but otherwise it runs Debian. The batteries are slimline pouch cells, with a custom controller board driven by an ESP32.

This must have cost quite a bit to build, but it’s something anyone can have a go at for themselves as everything is in a GitHub repository. Purists might ask for open source silicon at its heart to make it truly open source, but considering what he’s done we’ll take this. It’s not the first high quality laptop project we’ve seen by any means, but it may be the first that wouldn’t raise any eyebrows in the boardroom. Take a look at the video below the break.

youtube.com/embed/fks3PBodyiE?…

byran.ee/posts/creation/

hackaday.com/2025/01/23/this-h…

Si terrà a Firenze l’evento Voci nella cura – esperienza e scienza nella terapia psichedelica promosso da SIMEPSI Società Italiana di Medicina Psichedelica, in collaborazione con Centro Culturale The Square, Associazione Luca Coscioni e Psychedelicare.

L’appuntamento è per Sabato 1 febbraio alle ore 18:00, presso il Teatro del Centro Culturale The Square, a Firenze, in Via Domenico Cirillo, 1/r, 50133 Firenze FI.

Sarà l’occasione per firmare per l’appello italiano al parlamento e per l’ICE Psychedelicarepresso il banchetto della Cellula Coscioni Firenze.

è possibile visualizzare la locandina completa a questo link.

L'articolo A Firenze l’iniziativa “Voci nella cura – esperienza e scienza nella terapia psichedelica” proviene da Associazione Luca Coscioni.

If hacking on consumer hardware is about figuring out what it can do, and pushing it in directions that the manufacturer never dared to dream, then this is a very fine hack indeed. [Portasynthica3] takes on the Yamaha PSR-E433, a cheap beginner keyboard, discovers a shell baked into it, and takes it from there.

[Portasynthinca3] reverse engineered the firmware, wrote shellcode for the device, embedded the escape in a MIDI note stream, and even ended up writing some simple LCD driver software totally decent refresh rate on the dot-matrix display, all to support the lofty goal of displaying arbitrary graphics on the keyboard’s dot-matrix character display.

Now, we want you to be prepared for a low-res video extravaganza here. You might have to squint a bit to make out what’s going on in the video, but keep in mind that it’s being sent over a music data protocol from the 1980s, running at 31.25 kbps, displayed in the custom character RAM of an LCD.

As always, the hack starts with research. Identifying the microcontroller CPU lead to JTAG and OpenOCD. (We love the technique of looking at the draw on a bench power meter to determine if the chip is responding to pause commands.) Dumping the code and tossing it into Ghidra lead to the unexpected discovery that Yamaha had put a live shell in the device that communicates over MIDI, presumably for testing and development purposes. This shell had PEEK and POKE, which meant that OpenOCD could go sit back on the shelf. Poking “Hello World” into some free RAM space over MIDI sysex was the first proof-of-concept.

The final hack to get video up and running was to dig deep into the custom character-generation RAM, write some code to disable the normal character display, and then fool the CPU into calling this code instead of the shell, in order to increase the update rate. All of this for a thin slice of Bad Apple over MIDI, but more importantly, for the glory. And this hack is glorious! Go check it out in full.

MIDI is entirely hacker friendly, and it’s likely you can hack together a musical controller that would wow your audience just with stuff in your junk box. If you’re at all into music, and you’ve never built your own MIDI devices, you have your weekend project.

youtube.com/embed/u6sukVMijBg?…

Thanks [James] for the gonzo tip!

hackaday.com/2025/01/23/shellc…