141–150 of 414 posts
In the process, I accidentally damaged the (secondary) ice maker, so I called an appliance repair tech. After I explained the situation, he said I had a better chance of repairing it than he did.
It's a real world version of a bug that I was clever enough to create, but not clever enough to fix.
glibc had a dynamically allocated data structure to keep track of semaphores, but musl libc only had a fixed-size 256 element array. When the semaphore limit was exhausted, Ansible would fail to keep track of the connections, resulting in a network timeout error message. I fixed the problem by forking musl's semaphore functions, making the array resizable, and loading the implementation with LD_PRELOAD: https://github.com/chenxiaolong/musl-sem-ext. Worked perfectly for 6 years until we decommed our data center :)
Earlier quoted context omitted.
Single machine ... RabbitMQ. Using jpg for events locally. Using jpg for computer vision. I think I see the problem, it's this entire thing.
Most USB cameras send JPEG frames because USB 2.0 isn't nearly enough to support raw frames: 60 frames/second * 1920*1080 pixels/frame * 4 bytes/pixel = ~475MiB/s, while maximum USB 2.0 bandwidth is ~60MiB/s. You also don't want to store raw frames on the cloud storage, your bill would skyrocket. Those are some of the reasons for using JPEG. If you're using dockerized services (which are a must for NVidia-based CV, s…
What I found more entertaining was that two of the biggest names of the era were also vulnerable to commands to terminate forum text entry boxes, and begin displaying other parts of the page. Thus, a creative security tester could end the text fields box, and add commands to display other things.
Because part of this was interpreted server side, and partly client side, it was like a two for 1 enabling command execution server-side, and opening up the door for client side nefariousness too.
Providing a handy working link to download the SAM file on Windows from the repair directory, or output /etc/shadow
Anyways, as we began the 3rd piece, I looked at the 2nd bassoonist and told her she would have to play all the solos (which she hadn’t prepared for).
At intermission, I had a crazy idea, so I found my sister in the audience and asked her if she had a stick of gum. To my delight she did, so I chewed it up, stuck it to the back of the pad, and put the pad back on the instrument. To my surprise the hack worked, and I was able to complete the rest of the concert.
tl;dr: My snot nosed 20 year old self violated a school-owned $20,000 instrument with 10 cents worth of chewing gum at intermission, but managed to play all my solos, and then afterwards learned how to properly reseat pads with a lighter.
I was curious to see if they had checked out my personal website, so I grabbed my webserver logs and I recognized one IP from the city the job was based in. More than likely, the public IP of the business in question.
On a whim, I ran the IP through Shodan.io and it showed that 47808 was open - The BACNet protocol. I had no idea what this protocol was, but I was able to download some odd enterprisey software that had the ability to speak BACnet. I connected to the IP:Port and found a long list of connected things - water levels, temperatures, lights, and more.
I wasn't interested in doing anything questionable with this information. I'm not even certain it allowed me to do anything more than look, but I like to think I could have e.g. turned off lights or adjusted temperatures in the grow rooms. I made the (risky) executive decision to let the hiring manager know that their public IP had an important port open to the world. I wound up getting hired by that business, and the first task I was assigned was to fix the open port.
I'm not sure if that counts as "hacking", but I was proud of finding the vulnerability / misconfiguration nonetheless.
Another one was during high school as well, as an exchange student. In the computer science class there was a certain network game, and we were joking about high scores. So I checked out the score file format using hex editor, and created a tool that was able to modify the high score table.
When in the university, I needed to graduate soon, as I was heading to Silicon Valley. I had one weekend reserved to do a major statistics assignment. The assignment had to be done using a certain MS-DOS based tool, created by the professor. I had planned to use university computers to do it, but my electronic key had expired. It was not possible to extend the key during the weekend. It was possible to get a license for your own laptop, but even that required somebody to give you the licensing key, and that was not possible during the weekend. So I started my assignment by cracking the licensing for the tool. The licensing was based on a challenge, that was based on random number. Fortunately for me, the random number seed was the time (in seconds). So I put the machine to work for the first night, and it was able to brute-force the right challenge by resetting the system clock before each trial.
Later years one hack that I was proud about was creating an entry in the Linux drivers for my digital camera, and I submitted it as a patch as well.
Not a Windows guy, but I was working on a server software that was also ported to Windows. We had a weird timing bug that we knew approximately how to reproduce, but it was so rare we could not do it, and it was happening only with production version, not debug version, and only on Windows. We did not have a core dump (or whatever that was called on Windows at the time). So I created a framework to start the server, execute the operation on the server, and use Windows facilities catch crashes and save the core dump. With that framework I was able to find and fix the bug.
My latest proud hack is a system for time lapse microscopic photography. I have a lab microscope, and I mounted a Canon DSLR on top of it. An Arduino is connected to the camera through remote shutter port, so I can wake up the camera from sleep. I had to create the shutter control hardware on the Arduino from a remote shutter button. The Arduino is also controlling a stepper motor, which has a Lego wheel on, which on turn has a caterpillar track, which in turn is controlling the zoom on the microscope. This allows me to control the Arduino zoom. Then I have created custom keep-focus software, which uses images from the DSLR, and calculates how close the image is to the original, and tries various adjustments to find where the focus is closest.
Earlier quoted context omitted.
Single machine ... RabbitMQ. Using jpg for events locally. Using jpg for computer vision. I think I see the problem, it's this entire thing.
Most USB cameras send JPEG frames because USB 2.0 isn't nearly enough to support raw frames: 60 frames/second * 1920*1080 pixels/frame * 4 bytes/pixel = ~475MiB/s, while maximum USB 2.0 bandwidth is ~60MiB/s. You also don't want to store raw frames on the cloud storage, your bill would skyrocket. Those are some of the reasons for using JPEG. If you're using dockerized services (which are a must for NVidia-based CV, s…
Honestly, probably futzing around with Prince of Persia level assets in ResEdit to bypass the piracy check, as a child. My capacity for pride diminished with exposure to the world. More recently, replacing `7z.exe` with a PowerShell script that logged input, to get archive passwords for an obfuscated data format. Not technically impressive at all but a few days were saved and lolz were had.
Then I remembered my old Atari 8-bit programming days and the vertical blank interrupt (which there was on the PSX, but we couldn't run all the physics in the VBI time allotment). What we could do though, was to use setjmp/longjmp to switch contexts between threads and then hack the vertical blank interrupt to save off the registers from the main thread, longjmp back to the physics thread, which would then restore the registers of the main thread and longjmp back to it. Bingo, 29.94Hz pre-emptive two-threading (which was all we needed).
(I don't recall if we actually used setjmp/longjmp or if we just stored away the PC register to return from the interrupt and monkeyed with it to return from the interrupt to the physics thread [as if it was interrupted at the start of a cycle of the engine] and then return from there to code that would restore the registers and make it appear to the main thread that it was returning from a VBI.)