A bicycle is perhaps one of the most repairable pieces of equipment one can own — no matter what’s wrong with it, and wherever you are on the planet, you’ll be able to find somebody to fix your bike without too much trouble. Unfortunately as electric bikes become more popular, predatory manufacturers are doing everything they can to turn a bike into a closed machine, only serviceable by them.

That’s bad enough, but it’s even worse if the company happens to go under. As an example, [Fransisco] has a bike built by a company that has since gone bankrupt. He doesn’t name them, but it looks like a VanMoof to us. The bike features a light built into the front of the top tube of the frame, which if you can believe it, can only be operated by the company’s (now nonfunctional) cloud-based app.

The hack is relatively straightforward. The panel for the VanMoof electronics is removed and the works underneath are slid up the tube, leaving the connector to the front light. An off the shelf USB-C Li-Po charger and a small cell take the place of the original parts under a new 3D printed panel with a switch to run the light via a suitable resistor. If it wasn’t for the startling green color of the filament he used, you might not even know it wasn’t original.

We would advise anyone who will listen, that hardware which relies on an app and a cloud service should be avoided at all costs. We know most Hackaday readers will be on the same page as us on this one, but perhaps it’s time for a cycling manifesto to match our automotive one.

Thanks [cheetah_henry] for the tip.

hackaday.com/2025/04/24/a-bicy…

“Elusive Comet”, un gruppo di hacker motivati finanziariamente, prende di mira gli utenti e i loro wallet di criptovalute con attacchi di ingegneria sociale che sfruttano la funzionalità di controllo remoto di Zoom per indurre gli utenti a concedere loro l’accesso ai propri computer. La funzione di controllo remoto di Zoom permette ai partecipanti di assumere il controllo del computer di un altro partecipante.

Secondo l’azienda di sicurezza informatica Trail of Bits, che si è imbattuta in questa campagna di ingegneria sociale, i responsabili rispecchiano le tecniche utilizzate dal gruppo di hacker Lazarus nel massiccio furto di criptovalute Bybit da 1,5 miliardi di dollari .

“La metodologia ELUSIVE COMET rispecchia le tecniche alla base del recente attacco informatico da 1,5 miliardi di dollari a Bybit a febbraio, in cui gli aggressori hanno manipolato flussi di lavoro legittimi anziché sfruttare le vulnerabilità del codice”, spiega il rapporto Trail of Bits. L’azienda è venuta a conoscenza di questa nuova campagna dopo che gli autori della minaccia hanno tentato di condurre un attacco di ingegneria sociale contro il suo CEO tramite X messaggi diretti.

L’attacco inizia con un invito a un’intervista “Bloomberg Crypto” tramite Zoom, inviato a obiettivi di alto valore tramite account fittizi su X o via e-mail (bloombergconferences[@]gmail.com). Gli account falsi impersonano giornalisti specializzati in criptovalute o testate giornalistiche Bloomberg e raggiungono le vittime tramite messaggi diretti sulle piattaforme dei social media.

Gli inviti vengono inviati tramite link di Calendly per pianificare una riunione su Zoom. Poiché sia ​​gli inviti/link di Calendly che quelli di Zoom sono autentici, funzionano come previsto e riducono i sospetti del destinatario.

Durante la chiamata Zoom, l’aggressore avvia una sessione di condivisione dello schermo e invia una richiesta di controllo remoto alla vittima. Il trucco utilizzato in questa fase è che gli aggressori rinominano il loro nome visualizzato su Zoom in “Zoom”, in modo che il messaggio visualizzato dalla vittima reciti “Zoom richiede il controllo remoto del tuo schermo”, facendolo apparire come una richiesta legittima da parte dell’app.

Tuttavia, l’approvazione della richiesta fornisce agli aggressori il pieno controllo remoto sul sistema della vittima, consentendo loro di rubare dati sensibili, installare malware, accedere a file o avviare transazioni crittografiche.

L’aggressore potrebbe agire rapidamente per stabilire un accesso persistente impiantando una backdoor furtiva per sfruttarla in un secondo momento e disconnettersi, lasciando alle vittime poche possibilità di rendersi conto della compromissione.

L'articolo “Zoom richiede il controllo del tuo schermo”: la nuova truffa che sta colpendo manager e CEO proviene da il blog della sicurezza informatica.

There was a time when each and every printer and typesetter had its own quirky language. If you had a wordprocessor from a particular company, it worked with the printers from that company, and that was it. That was the situation in the 1970s when some engineers at Xerox Parc — a great place for innovation but a spotty track record for commercialization — realized there should be a better answer.

That answer would be Interpress, a language for controlling Xerox laser printers. Keep in mind that in 1980, a laser printer could run anywhere from $10,000 to $100,000 and was a serious investment. John Warnock and his boss, Chuck Geschke, tried for two years to commercialize Interpress. They failed.

So the two formed a company: Adobe. You’ve heard of them? They started out with the idea of making laser printers, but eventually realized it would be a better idea to sell technology into other people’s laser printers and that’s where we get PostScript.

Early PostScript and the Birth of Desktop Publishing

PostScript is very much like Forth, with words made specifically for page layout and laser printing. There were several key selling points that made the system successful.

First, you could easily obtain the specifications if you wanted to write a printer driver. Apple decided to use it on their LaserWriter. Of course, that meant the printer had a more powerful computer in it than most of the Macs it connected to, but for $7,000 maybe that’s expected.

Second, any printer maker could license PostScript for use in their device. Why spend a lot of money making your own when you could just buy PostScript off the shelf?

Finally, PostScript allowed device independence. If you took a PostScript file and sent it to a 300 DPI laser printer, you got nice output. If you sent it to a 2400 DPI typesetter, you got even nicer output. This was a big draw since a rasterized image was either going to look bad on high-resolution devices or have a huge file system in an era where huge files were painful to deal with. Even a page at 300 DPI is fairly large.

If you bought a Mac and a LaserWriter you only needed one other thing: software. But since the PostScript spec was freely available, software was possible. A company named Aldus came out with PageMaker and invented the category of desktop publishing. Adding fuel to the fire, giant Lionotype came out with a typesetting machine that accepted PostScript, so you could go from a computer screen to proofs to a finished print job with one file.

If you weren’t alive — or too young to pay attention — during this time, you may not realize what a big deal this was. Prior to the desktop publishing revolution, computer output was terrible. You might mock something up in a text file and print it on a daisy wheel printer, but eventually, someone had to make something that was “camera-ready” to make real printing plates. The kind of things you can do in a minute in any word processor today took a ton of skilled labor back in those days.

Take Two

Of course, you have to innovate. Adobe did try to prompt Display PostScript in the late 1980s as a way to drive screens. The NeXT used this system. It was smart, but a bit slow for the hardware of the day. Also, Adobe wanted licensing fees, which had worked well for printers, but there were cheaper alternatives available for displays by the time Display PostScript arrived.

In 1991, Adobe released PostScript Level 2 — making the old PostScript into “Level 1” retroactively. It had all the improvements you would expect in a second version. It was faster and crashed less. It had better support for things like color separation and handling compressed images. It also worked better with oddball and custom fonts, and the printer could cache fonts and graphics.

Remember how releasing the spec helped the original PostScript? For Level 2, releasing it early caused a problem. Competitors started releasing features for Level 2 before Adobe. Oops.

They finally released PostScript 3. (And dropped the “Level”.) This allowed for 12-bit colors instead of 8-bit. It also supported PDF files.

PDF?

While PostScript is a language for controlling a printer, PDF is set up as a page description language. It focuses on what the page looks like and not how to create the page. Of course, this is somewhat semantics. You can think of a PostScript file as a program that drives a Raster Image Processor (RIP) to draw a page. You can think of a PDF as somewhat akin to a compiled version of that program that describes what the program would do.

Up to PDF 1.4, released in 2001, everything you could do in a PDF file could be done in PostScript. But with PDF 1.4 there were some new things that PostScript didn’t have. In particular, PDFs support layers and transparency. Today, PDF rules the roost and PostScript is largely static and fading.

What’s Inside?

Like we said, a PostScript file is a lot like a Forth program. There’s a comment at the front (%!PS-Adobe-3.0) that tells you it is a PostScript file and the level. Then there’s a prolog that defines functions and fonts. The body section uses words like moveto, lineto, and so on to build up a path that can be stroked, filled, or clipped. You can also do loops and conditionals — PostScript is Turing-complete. A trailer appears at the end of each page and usually has a command to render the page (showpage), which may start a new page.
A simple PostScript file running in GhostScript
A PDF file has a similar structure with a %PDF-1.7 comment. The body contains objects that can refer to pages, dictionaries, references, and image or font streams. There is also a cross-reference table to help find the objects and a trailer that points to the root object. That object brings in other objects to form the entire document. There’s no real code execution in a basic PDF file.

If you want to play with PostScript, there’s a good chance your printer might support it. If not, your printer drivers might. However, you can also grab a copy of GhostScript and write PostScript programs all day. Use GSView to render them on the screen or print them to any printer you can connect to. You can even create PDF files using the tools.

For example, try this:

%!PS
% Draw square
100 100 moveto
100 0 rlineto
0 100 rlineto
-100 0 rlineto
closepath
stroke

% Draw circle
150 150 50 0 360 arc
stroke

% Draw text "Hackaday" centered in the circle
/Times-Roman findfont 12 scalefont setfont % Choose font and size
(Hackaday) dup stringwidth pop 2 div % Calculate half text width
150 exch sub % X = center - half width
150 % Y = vertical center
moveto
(Hackaday) show

showpage

If you want to hack on the code or write your own, here’s the documentation. Think it isn’t really a programming language? [Nicolas] would disagree.

hackaday.com/2025/04/24/from-p…

There’s just something about a satisfying “click” that our world of touchscreens misses out on; the only thing that might be better than a good solid “click” when you hit a button is if device could “click” back in confirmation. [Craig Shultz] and his crew of fine researchers at the Interactive Display Lab at the University of Illinois seem to agree, because they have come up with an ingenious hack to provide haptic feedback using readily-available parts.
An array of shapes showing some of the different possibilities for hapticoil soft buttons.
The “hapticoil”, as they call it, has a simple microspeaker at its heart. We didn’t expect a tiny tweeter to have the oomph to produce haptic feedback, and on its own it doesn’t, as finger pressure stops the vibrations easily. The secret behind the hapticoil is to couple the speaker hydraulically to a silicone membrane. In other words, stick the thing in some water, and let that handle the pressure from a smaller soft button on the silicone membrane. That button can be virtually any shape, as seen here.

Aside from the somewhat sophisticated electronics that allow the speaker coil to be both button and actuator (by measuring inductance changes when pressure is applied, while simultaneously driven as a speaker), there’s nothing here a hacker couldn’t very easily replicate: a microspeaker, a 3D printed enclosure, and a silicone membrane that serves as the face of the haptic “soft button”. That’s not to say we aren’t given enough info replicate the electronics; the researchers are kind enough to provide a circuit diagram in figure eight of their paper.

In the video below, you can see a finger-mounted version used to let a user feel pressing a button in virtual reality, which raises some intriguing possibilities. The technology is also demonstrated on a pen stylus and a remote control.

This isn’t the first time we’ve featured hydraulic haptics — [Craig] was also involved with an electroosmotic screen we covered previously, as well as a glove that used the same trick. This new microspeaker technique does seem much more accessible to the hacker set, however.

youtube.com/embed/-F2PaWVy2_I?…

hackaday.com/2025/04/24/haptic…