HNHacker News
TopNewBestAskShowJobs

dominicgs

416 karma · joined January 4, 2012

submissionscomments
dominicgs··on Odroid-U3: A quad-core 1.7GHz ARM single-board computer for $59
To answer my own question - this board (the ODROID) has a USB 2.0 OTG port.
dominicgs··on Odroid-U3: A quad-core 1.7GHz ARM single-board computer for $59
You may be able to pick up a board based on the Atheros AR9331, Alfa made one called the Hornet-UB [1], although I can only find them second hand (look for wifi pineapple mk4 for on ebay).

If you're looking to design your own hardware, there are plenty of ICs with dual NICs. For example the TI chip on the BeagleBone Black has dual ethernet NICs, but only one is used on the board.

[1] http://www.alfa.com.tw/products_show.php?pc=99&ps=50

dominicgs··on Odroid-U3: A quad-core 1.7GHz ARM single-board computer for $59
I love seeing all of these cheap ARM boards coming on to the market. I am a big fan of the BeagleBone Black but the supply problems recently have had me looking around for an alternative. Unfortunately my project uses the USB device port and there don't seem to be alternatives that offer USB device or OTG support.

Am I the only one who wants OTG support? Or are there boards with USB OTG ports that I have missed?

dominicgs··on Eavesdropping on a wireless keyboard (2013)
> Also, Bluetooth LE provides no eavesdropping protection. If an attacker can capture the pairing frames, they may be able to determine the "long-term key"

There's a practical attack for that, and it's quick. It also uses Ubertooth[1].

For all Bluetooth keyboards that I've seen in the past ~5 years the pairing process uses one of the "Secure Simple Pairing" modes. none of these have been broken, although "Just Works" is probably vulnerable. The keyboard that I've see use the "enter a 6 digit number" mode, which is not susceptible to man in the middle attacks that have been used against Bluetooth keyboards before[2].

Disclosure: I work on the Ubertooth and related projects.

[1] https://www.usenix.org/conference/woot13/workshop-program/pr...

[2] https://www.youtube.com/watch?v=X0RUN6SB6c8

dominicgs··on Eavesdropping on a wireless keyboard (2013)
There was a great talk at Defcon in 2009 about sniffing keystrokes with voltmeters and lasers. It's worth watching the video[1] if you're interested in this audio technique.

The first part of their presentation uses a novel method to pick up PS/2 keystrokes from a system's ground connection. This presentation was what lead me to design the PS/2 tap[2] to sniff keystrokes with my sound card.

[1] https://www.youtube.com/watch?v=9zq9DQAbWmU [2] https://github.com/dominicgs/PS2_tap

dominicgs··on Nest thermostat released in the UK
There's definitely a lot of variety in the London rental market, which isn't surprising given the size and age. I've had central controls, single thermostats, thermostatic radiator valves and, in one particularly sketchy conversion, radiators that were connected to someone else's heating system.

However, I wouldn't have paid someone to install the Nest thermostat in any of these properties because I didn't own them and I wasn't planning to stay long enough to benefit. I can't imagine that it would have been of any benefit to my landlords to install one either.

I presume that Nest's target market is homeowners, but their statement that there aren't many thermostats certainly appears to be based on anecdotal evidence from the rental market.

dominicgs··on Quake III bounty: we have a winner
This is anecdotal evidence from my own experience, so take it with a pinch of salt. I work on an open hardware project[1], I believe that we lose a significant portion of users (~50%) at each step deeper in to the development process. It seems that the steps are along the lines of: binaries - source releases - code from GitHub - updating firmware - compiling firmware - debugging hardware.

I think it would be useful to have a Virtualbox image available with everything set up for cross compiling for the Pi, BBB, etc. The thought of setting up non-standard toolchains seems to put off a lot of users.

I've also been working on a project[2] involving the BeagleBone Black and I saw a sharp increase in users when I began distributing an OS image with everything pre-installed.

[1] https://github.com/greatscottgadgets/ubertooth [2] https://github.com/dominicgs/USBProxy

dominicgs··on Donut math: how donut.c works (2011)
I had no problems using: gcc -o donut donut.c -lm

You may also have errors in your version of donut.c, try copying the version from http://www.a1k0n.net/2006/09/15/obfuscated-c-donut.html

dominicgs··on Steam Machine Teardown
There is an ISP switch on the board and the pins for programming may be on the header labeled "debug", although it's likely that those are JTAG. Either way, it should be easy to reprogram it. Not sure what you would do with 12 LEDs and a power button, but it's certainly possible.

The LPC11U37F in the controller could be worth a look too.

dominicgs··on Backpacker stripped of tech gear at Auckland Airport
Customs require you to reclaim any checked bags too, so you can be sure of meeting TSA before you get on another flight.
dominicgs··on LG Smart TVs log USB filenames and viewing info to LG servers
Samsung smart TVs are the same. I'm normally happy to view adverts if I am benefiting from whatever they fund - TV advert breaks paying for the content that I'm watching, in-app ads because I got the app for free, etc. With the adverts on the Samsung SmartHub all I can see is the software that I have already paid for.

Of course, the demo mode doesn't have advertising, so there is no way to know about it beforehand.

Potentially relevant link: http://www.samsungadhub.com

dominicgs··on $4.1m goes missing as Chinese bitcoin trading platform GBL vanishes
That's an interesting point. However, I think that the difference between forex and bitcoin in this situation is the goal of the end user. Many bitcoin users are using it because of the anonymity that the system provides, whereas users making large forex trades 10-20 years ago were mostly happy to add regulation and accountability to make sure that they received their money.

Forex traders may have been attracted to a market without regulation but their customers were there to make foreign currency trades. I'm sure that not as many bitcoin users would be happy to lose their anonymity to gain that accountability.

dominicgs··on Why Hardware Development Is Hard, Part 1: Verilog Is Weird
I'm not sure what sort of project you're interested in, but we're currently building open source network taps using PHY ICs and an FPGA. As part of the project a USB 3.0 core is being developed to move captured data to a host system.

https://github.com/mossmann/daisho

dominicgs··on How to Get a Job at a High Frequency Trading Firm
While I completely agree that there is no advantage over other HFT competitors provided by being located within the exchange datacentre, there is a disadvantage to not being there. This gives the exchange an opportunity to make a significant amount of money from each HFT company without hurting other customers.
dominicgs··on List of Open Source Licences in Mercedes Cars [pdf]
They probably are completely separate, but the use of wireless protocols is not necessarily confined to the entertainment system. For example, wireless tyre pressure/temperature sensors are installed in many cars and can be read with SDR hardware[1]. It's not too much of a leap to assume that false readings could be injected.

[1] http://sandiego.toorcon.net/2013/10/07/dude-wheres-my-car-re...

dominicgs··on List of Open Source Licences in Mercedes Cars [pdf]
Bluetooth is certainly one possibility, although libpcap can be used for a broad range of protocols, including USB and CAN, which are other candidates in a system like this.

Everything in this header that starts with DLT_ is a supported data link type: https://github.com/mcr/libpcap/blob/master/pcap/bpf.h

dominicgs··on HackRF, an open source SDR platform
You just need something that receives 2.4GHz and can give you signal strength (or calculate an FFT). Spectools [1] is a great tool for this, it already supports Ubertooth and could easily be adapted to work with HackRF.

Caveat: I work on Ubertooth for Michael Ossmann

[1] https://kismetwireless.net/spectools/

dominicgs··on Feds, We Need Some Time Apart
There were issues yesterday too: https://twitter.com/_defcon_/status/354873376675868674
dominicgs··on Your Feedback Matters – Update on Xbox One
Many new smart TVs do, and they have already begun to be exploited - https://www.youtube.com/watch?v=jA_2AiaAkvk
dominicgs··on Free private Github repos for students and edu people
That's exactly why we use SourceForge for Ubertooth, it gives us a good way to host released versions and some binary firmware images.

I mirror Ubertooth to Github because I was tired of having to answer the question "what's the Github URL?" from people wishing to browse the code.

dominicgs··on Lies on the London Underground [video]
This isn't too far away from Braess's paradox[1], which is based upon drivers making assumptions about the quickest path and attempting to optimize their journey at the cost of everyone's journey time.

It works for network traffic too as OSPF will pick the shortest path, but we can alter routing tables to correct for that.

[1] https://en.wikipedia.org/wiki/Braess%27s_paradox

dominicgs··on Bad as Shit
If you prefer not to use Google docs and just read the text, it's also part of the JRCB, so can be found here: http://www.textfiles.com/anarchy/JOLLYROGER/150.jrc

I remember being passed files from the cookbook on floppies at school, I thought it was the greatest sources of information at the time, along with the "Book of Forbidden Knowledge" that you used to be able to buy from ads in the back of magazines.

dominicgs··on This Is What One Half Second of High Speed Trading Looks Like
I believe that Taiwan (TSEC) does this, although I can't find a reference for it now.
dominicgs··on Bing doesn't support SSL
Australian Ebay (https://www.ebay.com.au/) has had the same problem for months, although I appear to get no response for https://www.ebay.com, so I'm not sure what their policy is on SSL access to the homepage.

I expect that Microsoft will fix Bing much more quickly.

dominicgs··on Crap I'm speaking at [insert conference here]. How do I prepare?
A call for papers that I read yesterday seemed to sum this up well:

"Your submission will be judged by your ability to communicate succinctly in writing, how good we think the talk sounds, what other people say about you behind your back and whether, frankly, we feel like people are going to be happy they paid money to see you yap for an hour."

It sounds a little harsh, but I think it's true. Getting to know people involved in the community or conference organization will pay off.

It's a big leap to go from a short user group presentation to hundreds of people listening to you for an hour. So you should expect to spend time getting to know people and money on attending other events in order to get there.

Of course, if you have a truly awesome new idea that nobody else has thought of, you can skip that step, but very few people do.

dominicgs··on StickNFinds - Bluetooth stickers help you find lost stuff
As he says in the video, they can't locate the position but can approximate distance from signal strength measurements.

To get location information would require one of the following: 1) An array of antennas pointing in different directions, this is certainly possible, but not using the single built in antenna in a smartphone.

2) The device to know its own location and to transmit this to the phone. This would only be as accurate as GPS and would use significantly more power.

Using signal strength to approximate distance is reasonable, but the location of the sensor, nearby objects and the design of the phone's antenna will all affect the measurements.

dominicgs··on StickNFinds - Bluetooth stickers help you find lost stuff
Devices like that have existed for some time now: http://www.amazon.com/Smart-Find-Remote-Control-Locator/dp/B...

I think that there is definitely a market for both products. I can't imagine some of my ageing relatives wanting to fire up an app to find their keys (they don't own smartphones anyway), but for my use I'd like the additional features that this solution provides.

Perhaps a StickNFind base station could be built at a later stage.

dominicgs··on Manhattanhenge
Such as the alleged alignment of the Box Tunnel on Brunel's birthday? http://en.wikipedia.org/wiki/Box_Tunnel#Brunel.27s_birthday
← PreviousPage 2 of 2