We finally have some answers about the Windows IPv6 vulnerability — and a Proof of Concept! The patch was a single change in the Windows TCP/IP driver’s Ipv6pProcessOptions(), now calling IppSendError() instead of IppSendErrorList(). That’s not very helpful on its own, which is why [Marcus Hutchins]’s analysis is so helpful here. And it’s not an easy task, since decompiling source code like this doesn’t give us variable names.

The first question that needs answered is what is the list in question? This code is handling the option field in incoming IPv6 packets. The object being manipulated is a linked list of packet structs. And that linked list is almost always a single member list. When calling IppSendErrorList() on a list with a single member, it’s functionally equivalent to the IppSendError() in the fixed code. The flaw must be in the handling of this list with multiple members. The only way to achieve that criteria is to send a lot of traffic at the machine in question, so it can’t quite keep up with processing packets one at a time. To handle the high throughput, Windows will assemble incoming packets into a linked list and process them in batch.

So what’s next? IppSendErrorList(), takes a boolean and passes it on to each call of IppSendError(). We don’t know what Microsoft’s variable name is, but [Marcus] is calling it always_send_icmp, because setting it to true means that each packet processed will generate an ICMP packet. The important detail is that IppSendError() can have side effects. There is a codepath where the packet gets reverted, and the processing pointer is set back to the beginning of the packet. That’s fine for the first packet in the list, but because the function processes errors on the entire list of packets, the state of the rest of those packets is now much different from what is expected.

This unexpected but of weirdness can be further abused through IPv6 packet fragmentation. With a bit of careful setup, the reversion can cause a length counter to underflow, resulting in data structure corruption, and finally jumping code execution into the packet data. That’s the Remote Code Execution (RCE). And the good news, beyond the IPv6-only nature of the flaw, is that so far it’s been difficult to actually pull the attack off, as it relies on this somewhat non-deterministic “packet coalescing” technique to trigger the flaw.

CVE Hunting Made Easy

[Eddie Zhang] wanted to take the easy road to finding CVEs. To his immense credit, he did not ask ChatGPT to hallucinate vulnerabilities for him, but instead built an automation chain to find possible vulns. The idea is simple: Download as many WordPress plugins as he could, run Semgrep over the corpus, throw the results in a SQL database, and take a closer look at the most promising findings.

That starts by writing a SQL query, naturally. The interesting flaws were SELECTed, and then the different plugins run in a test bench setup to try to trigger actual vulnerable code. And it’s not a bad approach, judging by the 14 CVEs found in 3 afternoons of work.

Moodle

RedTeam Pentesting got to have a field day with the Moodle platform. Moodle is a web-based distance learning solution written in PHP. And to get the flavor of how this went, the test grading logic is written in PHP — and eval()‘d on the server during grading. Now it’s not quite as bad as it sounds. There is sanitization done, and the set of symbols, characters, and functions are rather limited.

PHP has a pretty interesting type system. Something like acos(2), inverse of the cosine of 2, returns a result of Not a Number, or NAN. The dot . symbol does string concatenation in PHP, and putting those together, acos(2) . acos(2) results in a string, NANNAN. It gets better, as it’s then possible to do bitwise manipulation of those strings, eventually unlocking the entire alphabet. A few more tricks like PHP’s variable functions, variable variables, and other fun language contortions. Eventually we get to system() and escape into the system.

Hacking the TSA

[Ian Carroll] and [Sam Curry] bring an unfortunate tale of clever hacking, cover ups, and incompetence. The actual hack is pretty straightforward, a SQL injection in a login system. The real problem is that this login is in the official airline security systems that controls the Known CrewMember and Cockpit Access Security System. That’s the list of people that get to skip TSA checkpoints altogether, and that get access to airplane cockpits in flight. Not good.

The good news is that after disclosure, the Department of Homeland Security quickly secured the vulnerable site. The takes a turn for the worse, when it came time for disclosure. TSA issues a factually incorrect statement about what is required to use the KCM system. [Ian] and [Sam] reached out again to try to set the record straight about the severity of the finding. In response, the TSA quietly deleted the FAQ that spells out how bad the vulnerability could be. Not a great look.

Bits and Bytes

For your data and packet capture needs, Wireshark 4.4 is out. Among the normal improvements, there’s better VoIP support, a handful of new protocols, and some IPv6 tweaks to make life easier.

Ever wondered how to do effective sandboxing in Linux? Hardened Linux has you covered. There are some obvious things like limited filesystem access, but it might be more useful to read about seccomp to limit the available system calls to your sandboxed program. The article is an overview of the individual techniques, and then some of the more popular all-in-one solutions like firejail, bubblewrap, and landlock.

Volt Typhoon, a collection of hackers believed to be working on behalf of the Chinese government has begun using a vulnerability in Versa Director to attack businesses. Version 22.1.4 of the network management platform fixes the vulnerability, which allowed for executable java filew to be disguised as PNGs and uploaded to the platform.

And finally, one of the sneakier ways to stay on a Linux system is to use udev. For attackers, it’s always a challenge to make sure the malware starts up on each boot, and yet doesn’t attract any attention. There are plenty of places to hide a startup hook, but this one creates a udev rule to automatically run early in boot when the /dev/random device is created. How often do you audit your udev files? Sneaky!

hackaday.com/2024/08/30/this-w…

If you think about it, even difficult mazes on paper are pretty easy. You can see all the places you can and can’t go, and if you use a pencil instead of a pen, well, that’s almost like cheating.

However, using a pencil is pretty much a necessity to play [penumbriel]’s Blind Maze. In this game, you can’t even see the maze, or where you are. Well, that’s not exactly true — you can “touch” the wall (or lack thereof) in front of you and to the sides, but that’s it. So you’re going to need that pencil to draw out a map as you go along.

This game runs on an Arduino Nano and a 18650 cell. There are three LEDs deep within the enclosure, which is meant to give the depth of walls. But, even the vision-impaired can play the Blind Maze, because there’s haptic feedback thanks to a small vibration motor.

If you want to play in hard mode, there’s a hidden paperclip-accessible switch that turns off the LEDs. This way, you have to rely on hitting the walls with your head. Be sure to check out the video below.

youtube.com/embed/rd01wIHwtz8?…

hackaday.com/2024/08/29/2024-t…

The Bus Pirate multi-tool has held a place of honor in many a hardware hacker’s toolbox for years, and the latest generation of the gadget powered by the Raspberry Pi RP2040/RP2350 offers significantly enhanced capabilities over the original PIC versions. We took a look at the new Bus Pirate when it started shipping back in February, and while the firmware was still in the early stages back then, it was already clear that creator [Ian Lesnet] and his team had put together a compelling product.

Over the last several months, the Bus Pirate software has improved dramatically. New features have started showing off the hardware’s capabilities, and the user experience is far improved over where it was at release. Following the firmware development is a roller coaster ride, with [Ian] sometimes pushing out several updates a day. Luckily, like the Pi Pico itself, updating the new Bus Pirate only takes a second.

But as impressive and important as those software updates have been, that’s not what we’re talking about today. In this post, we’ll take a look at one of the most exciting aspects of the new Bus Pirate — the ability to easily develop add-on modules for it.

Bus Pirate Versions

Before we get too far, I should mention that there are now a couple of new Bus Pirate versions on the market, which makes talking about the product a little confusing.
The new Bus Pirate 6
The Bus Pirate 5, which started shipping in February and remains available, is powered by the RP2040. It is the first major version of the hardware to see a wide release since the Bus Pirate 3. Since the team got early access to the RP2350 chip, they were also able to produce two new variants: the 5XL and the 6.

What are the differences between them all? The 5XL uses the RP2350A and is essentially just a faster version of the 5 thanks to the more powerful cores and additional RAM offered by the new Raspberry Pi silicon. The 6 is based on the RP2350B and takes advantage of the additional GPIO pins by deleting some of the I/O expander chips that were necessary on the 5 and 5XL. This not only makes I/O faster but frees up space on the board to implement a “follow along” logic analyzer that automatically records everything that’s happening on the bus.

All that being said, for the purposes of this article, it doesn’t actually matter.

One Port To Rule Them All

Regardless of which version of the Bus Pirate you get (5/5XL/6), they all feature the same 10-pin connector on the side. This is where you’d normally connect up your probes, and thanks to the display on the top of the Bus Pirate, you don’t even have to remember the pinout — when you switch modes on the device, the screen will be updated to show which pin does what.

This is where things start to get interesting. Since the connector on the side is nothing more exotic than a male 2.54 mm pitch header, interfacing with it through custom hardware is incredibly simple. You don’t need to hunt down some special connector — making a board that can plug into the BP5 (or beyond) can be as easy as soldering a female header onto a scrap of perfboard. Even better, since you don’t have to worry about creating a custom footprint, developing your own add-on PCBs is a breeze.

Designing Custom Expansions

Creating your own piece of hardware that plugs into the Bus Pirate is as easy as adding a right-angle 2.54 mm female header to the edge of your PCB. You might think the fact that the pinout changing depending on what mode the device is in would be a problem, but in practice, your add-on is likely going to require the user to set a corresponding mode anyway (I2C, SPI, UART, etc).

Over on the Bus Pirate forums, user [grymoire] is responsible for coming up with the idea of calling these expansions “planks” after drawing comparisons with the “hats” and “shields” used by other development boards. Why a plank? Well, for one, it fits the pirate theme. When plugged into the Bus Pirate, the expansions also look a bit like a plank hanging out over the side of a pirate ship.

As an example, I recently put together the SAO Plank: a small adapter that lets me connect three Simple Add-Ons to the Bus Pirate. This is not only a convenient way of powering the badge expansions and monitoring their current consumption using the Bus Pirate’s onboard display, but it also provides a way to debug and test I2C communications between several SAOs — a capability that will become more useful as we get closer to Supercon 2024.

There’s really not much going on in the SAO Plank, and frankly, I could have wired the thing up on a perfboard. Even the power LED I added is technically superfluous, as the technicolor lights produced by the Bus Pirate leave no question as to whether or not it’s turned on. But it was so cheap and easy to turn this into its own board, so why not?

I’m eager to see what the community comes up with when presented with such a low-friction path to coming up with custom Bus Pirate expansions.

Collect Em’ All

Bus Pirate planks aren’t just limited to DIY. Since releasing the Bus Pirate 5, a number of official planks have been introduced. Some of these are still in development, such as the “IR Toy” that [Ian] has been documenting in a thread on the forums. Others are already available for purchase, such as an assortment of adapters that make it easier to work with SPI flash chips and one for interfacing with SLE4442 Secure Memory Cards.

One of the advantages of the official planks is that the firmware is likely to get baked-in support for any special functions they may have. Even though the IR Toy hasn’t officially been released, last week a new mode was added to the stable build of the firmware that can interface with it and send NEC IR codes. Then again, as the firmware is open source, even DIY planks could get their own modes should somebody be so inclined to write the code for them.

Whether they’re an official product or a homebrew project from the community, the Bus Pirate Planks are a very exciting addition to an already fantastic tool. If you happen to see an interesting Plank in the wild, or end up making one yourself, be sure to let us know.

It may be the last gasp of summer here in the Northern Hemisphere, but it’s always cold somewhere, whether it’s outdoors or inside. If you suffer from cold, stiff hands, you know how difficult it can be to work comfortably on a computer all day. Somehow, all that typing and mousing does little to warm things up. What you need are hand warmers, obviously, and they might as well be smart and made to fit your hands.

Fifteen-year-old [Printerforge] created these bad boys in an effort to learn how to code LCDs and control heat like Magneto controls ferrous metals. Thanks to digital control, they can heat up to specific temperatures, and they happen to run for a long time.

Power-wise, these warmers use a 18650 cell and a TP4056 charging module. Everything is controlled by an Arduino Nano, which reads from both a thermistor and a potentiometer to control the output.

[Printerforge] really thought this project through, as you’ll see in the Instructable. There’s everything from a table of design requirements to quick but thorough explanations of nichrome wire and basic electronic theory.

And then there’s the material consideration. [Printerforge] decided that polymer clay offers the best balance of heat conductivity and durability. They ended up with two styles — flat, and joystick grip. The best part is, everything can fit in a generous pocket.

Clay is good for a lot of things, like making the perfect custom mouse.

hackaday.com/2024/08/30/adjust…

Recently Raspberry Pi released the 2GB version of the Raspberry Pi 5 with a new BCM2712 SoC featuring the D0 stepping. As expected, [Jeff Geerling] got his mitts on one of these boards and ran it through its paces, with positive results. Well, mostly positive results — as the Geekbench test took offence to the mere 2 GB of RAM on the board and consistently ran out of memory by the multi-core Photo Filter test, as feared when we originally reported on this new SBC. Although using swap is an option, this would not have made for a very realistic SoC benchmark, ergo [Jeff] resorted to using sysbenchinstead.

Naturally some overclocking was also performed, to truly push the SoC to its limits. This boosted the clock speed from 2.4 GHz all the way up to 3.5 GHz with the sysbench score increasing from 4155 to 6068. At 3.6 GHz the system wouldn’t boot any more, but [Jeff] figured that delidding the SoC could enable even faster speeds. This procedure also enabled taking a look at the bare D0 stepping die, revealing it to be 32.5% smaller than the previous C1 stepping on presumably the same 16 nm process.

Although 3.5 GHz turns out to be a hard limit for now, the power usage was interesting with idle power being 0.9 watts lower (at 2.4 W) for the D0 stepping and the power and temperatures under load also looked better than the C1 stepping. Even when taking the power savings of half the RAM versus the 4 GB version into account, the D0 stepping seems significantly more optimized. The main question now is when we can expect to see it appear on the 4 and 8 GB versions of the SBC, though the answer there is likely ‘when current C1 stocks run out’.

hackaday.com/2024/08/30/new-2-…

slowforward.net/2024/08/29/jpg…

slowforward

2024-08-29 09:31:13

Shi Hui (nata a Shanghai nel 1955; vive e lavora a Hangzhou, Cina), Writing-Non-Writing I
The Eight Principles of Yong, 2021

slowforward.net/2024/08/29/jpg…

#art #arte #biennale #Biennale2024 #BiennaleDiVenezia #BiennaleDiVenezia2024 #FabioPoggi #foto #jpg #jpgBiennale #jpgBiennale24 #report #ShiHui #TheEightPrinciplesOfYong #Venezia2024 #WritingNonWritingI

jpg.biennale24_3 / fabio poggi. 2024

Shi Hui (nata a Shanghai nel 1955; vive e lavora a Hangzhou, Cina), Writing-Non-Writing I The Eight Principles of Yong, 2021

^slowforward

slowforward.net/2024/08/29/da-…

slowforward

2024-08-29 06:31:00

Agosto

Il 29 agosto s’inaugura alle 17:00 la mostra Giuliano Scabia e Franco Basaglia in viaggio accanto alla follia: da Marco Cavallo al Drago di Montelupo presso Murate Art District (M.A.D., Piazza delle Murate).

La mostra sarà visitabile fino al 26 settembre.

Il 29 agosto alle 18:00, in occasione dell’inaugurazione, l’Accademia della Follia – Claudio Misculin metterà in scena lo spettacolo Quelli di Basaglia… A 180 gradi.

Sempre alle 18:00, il 31 agosto: Teatro al tramonto (con momento conviviale) nel campo di Paolo sulle colline di Marignolle in Via Bernardino Poccetti, 19, Firenze (nei pressi della località Due Strade). Parteciperanno il Teatro delle Ariette con Lettera ai Cavalli di Trieste di Giuliano Scabia e Pacifica Brigata Giuliano Scabia con Canto della vita indistruttibile di Giuliano Scabia, il sassofonista Dimitri Grechi Espinoza, la violoncellista Margherita Scabia e Annibale Pavone che interpreterà Apparizione di un teatro vagante sopra le selve, da Teatro con bosco e animali, Einaudi 1987.

Settembre

Il 5 settembre, presso Murate Art District (M.A.D., Piazza delle Murate), dalle 17:00 proiezione di filmati originali, tra l’altro sull’esperienza di Marco Cavallo (1973) e sul Drago di Montelupo (2003).

Il 19 settembre ore 21:00 al M.A.D. Sandro Lombardi e Annibale Pavone interpreteranno La luce di dentro di Giuliano Scabia, dal libro omonimo, Titivillus 2010.

Il 25 settembre ore 16:00 al M.A.D. Per un teatro dell’impegno, primo incontro con le realtà toscane che lavorano con il disagio e con la follia.

Il 26 settembre ore 20:30, in occasione del termine della mostra, al M.A.D., azione teatrale di Claudio Ascoli (Chille della Balanza), Lettere del filosofo Guido Calogero dal carcere duro delle Murate (febbraio-giugno 1942); alle 21:30 I sacchi di sabbia interpretano Cinghiali al limite del bosco di Giuliano Scabia, da Teatro con bosco e animali.

fondazionegiulianoscabia.it/te…

slowforward.net/2024/08/29/da-…

#follia #FrancoBasaglia #GiulianoScabia #ilDragoDiMontelupo #incontri #MAD_ #MarcoCavallo #MurateArtDistrict

Quelli di Basaglia... a 180 gradi | Estate Fiorentina

L'Accademia della Follia parteciperà all'Estate Fiorentina 2024 con lo spettacolo 'Quelli di Basaglia...

^{Giulia Misculin (Accademia della Follia - Claudio Misculin)}

slowforward.net/2024/08/29/por…

slowforward

2024-08-28 23:40:29

instagram.com/reel/C97TXilC06q…

.

slowforward.net/2024/08/29/por…

#art #arte #Basquiat #JeanMichelBasquiat

Roland-Philippe Kretzschmar on Instagram: "‘Portrait of the Artist as a Young Derelict’ was produced in 1982 in the midst of Jean-Michel Basquiat’s meteoric rise to success. The painting’s title is inspired by James Joyce’s ‘A Portrait of the Artist as A

17K likes, 161 comments - theartbystander on July 27, 2024: "‘Portrait of the Artist as a Young Derelict’ was produced in 1982 in the midst of Jean-Michel Basquiat’s meteoric rise to success.

^Instagram

noblogo.org/transit/camarillo-…

Transit

2024-08-28 13:47:05

Camarillo Brillo Sessions 8 (158)

Ho visto la luce (Nick Cave & The Bad Seeds – “Wild Good”)

La vita, checché ne dicano coloro che la incensano anche quando non è cosa, la mette giù besa a tutti, prima o poi. Non è che soldi, fama, intelligenza o stupidità ti mettano al riparo. Qui ci sono fantasmi di perdite (il figlio Arthur, Anita Lane...) e di dolore, tanto. Qui ci sono i “Bad Seeds” e anche Warren Ellis (con lui Cave firma tutte la musica del disco), c'è luce, ma sospesa tra le due tenebre di Nabokov.

C'è un'opera che rappresenta una sciabolata nel buio, che porta in sé la speranza dell'oggi, l'unico tempo che possiamo vivere appieno. Il passato non ci deve appartenere più ed il futuro non si può comprendere: ora, adesso, è la sola via. Una strada che Nick Cave abbraccia da par suo. Non dimentichiamoci lo spessore di questo artista, capace [nel tempo, appunto] di valicare gli anni e le storie, capace di scrivere pagine di fulgida e tenebrosa bellezza senza mai scadere nel banale.

Da “Ghosteen” sembra passato un secolo, dagli altri suoi dischi anche di più. In mezzo tanta musica, moltissime parole (seguite il suo sito, “The Red Hand Files”, gioiello di comunicazione) e la vita, la sua, quella di tutte. Nei cori di questa opera sentiamo il desiderio tormentoso di respirare di nuovo. E solo lui può rendere accessibile una canzone come “Conversion”, che in bocca e nelle mani di altri apparirebbe fin troppo magniloquente. La butta là ed è veramente come un girotondo di sollievo.

Le rane che saltano in “Frogs” sembrano tutti noi, così convinti che i nostri sforzi per stare sulla ribalta dell'esistenza siano una cosa seria, ma è un gioco: può essere crudele, ma può anche divertirci, e tanto. Ci sono canzoni oggettivamente belle in sè (“Song of the Lake” e “Wild Good” una dietro l'altra) e altre che ti spezzano letteralmente il cuore (ce l'avete ancora?), come “O Wow O Wow (How Wonderful She Is)”, un quadro di note per Anita Lane, mai dimenticata.

Ci sono bozze di un altra rinascita in “Waters Cover the Sea”, ma è una delle tante di questo disco, una delle infinite che ogni uomo e donna su questa sfigata terra possono concedersi. Ci sono i rimandi a Isaia e San Giovanni, perchè un uomo dalla cultura e dalla sensibilità di Cave non fa questioni di bassa lega e guarda a se stesso nella scrittura, nella ricerca della fede, nella cultura, negli altri.

Ci sono fischi e archi, ci sono chitarre e (ops!) un pochina di elettronica qui e là. E' un disco di un gruppo che si ritrova a suonare assieme dopo qualche tempo, ma con un leggerezza forse inaspettata. Ci sono 41 minuti che vanno ripetuti, riascoltati e in qualche modo assimilati. C'è un pochino della storia di tutti, qua dentro, che solo i grandi artisti sanno cantare per come è, non per come vorremmo che fosse.

C'è tanto Nick Cave, che, in fondo, non basta mai, no?

Mastodon: @alda7069@mastodon.unoX: @[url=https://mastodon.uno/users/alda7069]A&D :antifa:[/url] Telegram: t.me/transitblogFriendica: @danmatt@poliverso.org

Gli scritti sono tutelati da “Creative Commons” (qui)

Tutte le opinioni qui riportate sono da considerarsi personali. Per eventuali problemi riscontrati con i testi, si prega di scrivere a: corubomatt@gmail.com

Transit

Il blog di Alessandra Corubolo & Daniele Mattioli. On line -in varie forme- dal 2005.

^Telegram

slowforward.net/2024/08/28/ind…

slowforward

2024-08-28 13:29:45

grazie a Gaetano Altopiano per la sempre generosa ospitalità sul suo sito:

ilcucchiaionellorecchio.it/202…
_

slowforward.net/2024/08/28/ind…

#000000 #808080 #ffffff #frammento #IlCucchiaioNellOrecchio #indicazioniDiDirezioni #prosa #ProsaInProsa #segni #testiDiMgInRete #testiDiMgOnline

“indicazioni di direzioni”, di mg, sul ‘cucchiaio nell’orecchio’

grazie a Gaetano Altopiano per la sempre generosa ospitalità sul suo sito: _

^slowforward

slowforward.net/2024/08/28/nel…

slowforward

2024-08-28 10:31:24

youtube.com/embed/AuAu_EFTnvE?…

Il percorso umano, intellettuale e artistico del pittore olandese Mondrian, pioniere dell’astrattismo che, con Malevitch e Kandinskij, ha rappresentato un punto di svolta nell’arte del Novecento. Il documentario ripercorre l’evoluzione artistica di Piet Mondrian, dalle prime opere di ispirazione impressionista fino alla codifica di un linguaggio universale ed essenziale per la rappresentazione della natura. Inizialmente influenzato dal Cubismo, il pittore ha raggiunto, attraverso l’esperienza parigina prima e il movimento artistico De Stijl poi, la capacità di raccontare la realtà attraverso i colori e le forme geometriche fondamentali, influenzando profondamente, se non addirittura anticipando di vent’anni, quella che sarà l’estetica degli Anni Sessanta e oltre.

slowforward.net/2024/08/28/nel…

#art #arte #Mondrian #PietMondrian

nello studio di mondrian

Il percorso umano, intellettuale e artistico del pittore olandese Mondrian, pioniere dell’astrattismo che, con Malevitch e Kandinskij, ha rappresentato un punto di svolta nell’arte del …

^slowforward