Image

This Week In Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, And More

It’s no longer a proper month without Microsoft breaking its own record for security fixes, and October’s Patch Tuesday was no exception. Brian Krebs brings the roundup: more than 1,400 vulnerabilities fixed in a single batch, dwarfing September’s record of nearly 1,000, which itself was about ten times the normal monthly load. According to Tenable, Microsoft has now passed 4,000 CVEs for the year with two months still to go.

Only one of the fixes is for a vulnerability already being exploited in the wild: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch, giving attackers a head start, and with modern AI tooling, it seems like not much of a head start is needed. At least 78 of the bugs are rated critical, and most of those allow remote code execution with little or no user interaction. Windows 10 holdouts can relax a little: Microsoft quietly extended free updates through October 2027.  Given the pace of exploitation, this is probably the only way to prevent an Internet-scale meltdown.

Microsoft credits LLM-driven bug hunting for the volume, which leaves the poor admins who have to test and deploy all of this in an unenviable spot. Fortra’s analysis shows that only 26 Microsoft vulnerabilities have landed in the CISA KEV catalog of actively exploited bugs so far this year, so start there. For the rest, the SANS Internet Storm Center and Cisco Talos have the usual breakdowns by severity. Or, you know, just patch everything and hope for the best, which is roughly what everyone does anyhow.

Continue reading “This Week In Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, And More” →

Image

FLOSS Weekly Episode 772: Raspberry Pi From The Man Himself

This week, Jonathan Bennett and Elliot Williams talk with Eben Upton about the Raspberry Pi! The conversation covers the new Pi 5, the upcoming CM5, the possible Pi500, and the Initial Public Offering (IPO) that may happen before too long. There’s also the PCIe port, the RP1, and the unexpected effects of using Broadcom chips. And then we ask the Billion Dollar question: What’s the money from an IPO going to fund? New hardware, software upgrades, better documentation? Nope, and the answer surprised us, too.

Continue reading “FLOSS Weekly Episode 772: Raspberry Pi From The Man Himself” →

Image

AppCAD Does Transmission Lines

Broadcom and Agilent are perhaps not household words in every household, but among those who work with RF, they are common enough names. An Agilent developer wrote AppCAD to help with common RF design computations and now works for Avago who bought Broadcom. But whoever’s branding is on it, you can download the tool from Broadcom or check out the latest beta version. Then watch [IMASI Guy’s] video below on how to use part of it.

What can it do? According to the website:

  • S-Parameter Analysis and Plotting
  • Active Circuit Bias Design
  • Cascade Noise and IP3 Analysis
  • Transmission Line Analysis
  • Signals and Systems
  • Complex Math Engineering Calculator

Continue reading “AppCAD Does Transmission Lines” →

Image

The Raspberry Pi 3B+ As An SDR – Without The SDR!

We’ve become used to software-defined radio as the future of radio experimentation, and many of us will have some form of SDR hardware. From the $10 RTL USB sticks through to all-singing, all-dancing models at eye-watering prices, there is an SDR for everyone.

What about the idea of an SDR without any external hardware? Instead of plugging something into your Raspberry Pi, how about using the Pi itself, unmodified? That’s just what the Nexmon SDR project has achieved, and this has been made possible through clever use of the on-board Broadcom 802.11ac WiFi chip. The result is a TX-capable SDR, albeit one only capable of operating within the 2.4 GHz and 5 GHz spectrum used by WiFi.

The team had previously worked extensively with the chipset in the Nexus 5 phone, and the SDR extension was first available on that platform. Then along came the Raspberry Pi 3 B+ with a similar-enough WiFi chipset that the same hack was portable to that platform, et voilá: WiFi SDR on a Pi 3 B+.

If you’ve not looked at the Pi 3 B+ we’d like to direct you to our review. If you don’t have a Nexus 5 kicking around, and you’d like to do some WiFi-band SDR work, it’s looking like an amazing deal.

Via rtl-sdr.com.

Hackaday Links Column Banner

Hackaday Links: November 19, 2017

[Peter]’s homebuilt ultralight is actually flying now and not in ground effect, much to the chagrin of YouTube commenters. [Peter Sripol] built a Part 103 ultralight (no license required, any moron can jump in one and fly) in his basement out of foam board from Lowes. Now, he’s actually doing flight testing, and he managed to build a good plane. Someone gifted him a ballistic parachute so the GoFundMe for the parachute is unneeded right now, but this gift parachute is a bit too big for the airframe. Not a problem; he’ll just sell it and buy the smaller model.

Last week, rumors circulated of Broadcom acquiring Qualcomm for the sum of One… Hundred… Billion Dollars. It looks like that’s not happening now. Qualcomm rejected a deal for $103B, saying the offer, ‘undervalued the company and would face regulatory hurdles.’ Does this mean the deal is off? No, there are 80s guys out there who put the dollar signs in Busine$$, and there’s politicking going on.

A few links posts ago, I pointed out there were some very fancy LED panels available on eBay for very cheap. The Barco NX-4 LED panels are a 32×36 panels of RGB LEDs, driven very quickly by some FPGA goodness. The reverse engineering of these panels is well underway, and [Ian] and his team almost have everything figured out. Glad I got my ten panels…

TechShop is gone. With a heavy heart, we bid adieu to a business with a whole bunch of tools anyone can use. This leaves a lot of people with TechShop memberships out in the cold, and to ease the pain, Glowforge, Inventables, Formlabs, and littleBits are offering some discounts so you can build a hackerspace in your garage or basement. In other TechShop news, the question on everyone’s mind is, ‘what are they going to do with all the machines?’. Nobody knows, but the smart money is a liquidation/auction. Yes, in a few months, you’ll probably be renting a U-Haul and driving to TechShop one last time.

3D Hubs has come out with a 3D Printing Handbook. There’s a lot in the world of filament-based 3D printing that isn’t written down. It’s all based on experience, passed on from person to person. How much of an overhang can you really get away with? How do you orient a part correctly? God damned stringing. How do you design a friction-fit between two parts? All of these techniques are learned by experience. Is it possible to put this knowledge in a book? I have no idea, so look for that review in a week or two.

Like many of us, I’m sure, [Adam] is a collector of vintage computers. Instead of letting them sit in the attic, he’s taking gorgeous pictures of them. The collection includes most of the big-time Atari and Commodore 8-bitters, your requisite Apples, all of the case designs of the all-in-one Macs, some Pentium-era PCs, and even a few of the post-97 Macs. Is that Bondi Blue? Bonus points: all of these images are free to use with attribution.

Nvidia is blowing out their TX1 development kits. You can grab one for $200. What’s the TX1? It’s a really, really fast ARM computer stuffed into a heat sink that’s about the size of a deck of cards. You can attach it to a MiniITX breakout board that provides you with Ethernet, WiFi, and a bunch of other goodies. It’s a step above the Raspberry Pi for sure and is capable enough to run as a normal desktop computer.

Image

Mergers And Acquisitions: Broadcom, Qualcomm, And One Hundred Billion Dollars

Rumors have been circulating this last weekend of the largest semiconductor acquisition ever. Broadcom might buy Qualcomm for the princely sum of one hundred Billion dollars.

You will most likely be familiar with both Qualcomm and Broadcom for their wireless and cellphone chipsets. As far as the Maker community is concerned, Broadcom makes the chipset for the Raspberry Pi, but in the context of a two hundred Billion dollar company, a ‘maker’ focused Linux dev board is the equivalent of a rounding error on a balance sheet.

This news comes a little more than a year after the announcement that Qualcomm is snatching up NXP, and two years after the news of NXP is merging with Freescale. The industry is in a state of consolidation.

This proposed deal follows several other semiconductor mergers and acquisitions including NXP and Freescale, Intel and Altera, Avago and Broadcom, On Semiconductor and Fairchild, and the one we’re most befuddled with, Atmel and Microchip. Why are these companies merging? Because they’re sitting on mountains of cash. All of these mergers with the exception of Avago and Broadcom, have been for single-digit Billions of dollars. The merger of Broadcom and Qualcomm — if it happens — will be the largest merger of two semiconductor companies ever. That’s easy to do when both Broadcom and Qualcomm are on the top ten list of largest semiconductor companies, but it is evidence enough that the mergers and acquisitions in the industry are not slowing down.

Image

Broadpwn – All Your Mobiles Are Belong To Us

Researchers from Exodus Intel recently published details on a flaw that exists on several Broadcom WiFi chipsets. It’s estimated to affect nearly 1 Billion devices, from Android to iPhone. Just to name a few in the top list:

  • Samsung Galaxy from S3 through S8, inclusive
  • All Samsung Notes3. Nexus 5, 6, 6X and 6P
  • All iPhones after iPhone 5

So how did this happen? And how does a bug affect so many different devices?

A smart phone nowadays is a very complicated mesh of interconnected chips. Besides the main processor, there are several other secondary processors handling specialized tasks which would otherwise clog up the main CPU. One of those is the WiFi chipset, which is responsible for WiFi radio communications — handling the PHY, MAC and MLME layers. When all the processing is complete, the radio chipset hands data packets over the kernel driver, which runs on the main CPU. This means that the radio chipset itself has to have some considerable data processing power to handle all this work. Alas, with great power comes great responsibility.

Continue reading “Broadpwn – All Your Mobiles Are Belong To Us” →