News archive July 2022 - Koos van den Hout

After I visited earlier Dutch hacker events HEU, HIP97, HAL2001, WTH2005 I missed HAR2009, OHM2013 and SHA2017. I can only say 'life happened' because my son was born in the interim and my interests changed.

In the beginning of this year I heard about the new planning for May Contain Hackers as the original plan was for 2021 and it was postponed due to covid-19. I started thinking about attending and when the opportunity to get a free ticket arose due to my links with Surf I got serious.

Life is still happening so I coordinated with the rest of the family whether I could be missed at home and for how long. The result was that I would go Friday evening until Tuesday afternoon and I would go there by recumbent bicycle with the luggage trailer so the rest of the family could use the car.

The people from Surf set up our own village Village:SMRF next to Village:OS3. I slept in my own tent because I really want my rest at night and I want that rest at a somewhat normal schedule (not really a hacker schedule). I brought a 1-person tent, a sleeping bag, clothes, gear to make breakfast with tea and coffee, a smartphone with charger and a handheld radio with charger. Having to move all my luggage myself on the recumbent bicycle made me very selective in what to bring.

I went to several talks spoke a number of well-known people, got to know new ones, saw people there I didn't expect and had a good time.

What I really enjoyed was the friendly atmosphere. One aspect of that caught my attention: besides people with non-traditional clothing and hairstyles I saw several people who looked like they were somewhere in a gender transitioning process. They felt free at MCH to be themselves. One person responded to me when I shared this observation: "I saw more LGTB flags here than at Pride in Amsterdam".

Also MCH was really non-commercial. Mentions of the sponsors were minimal and never in-your-face.

The weather cooperated a lot! It might have been quite different with bad weather. There was some rain before Friday so I saw mentions of "Mud Contains Hackers" on twitter. Saturday and Sunday were hot, Monday was cooler. Tuesday started with rain and some more showers, so my tent wasn't completely dry when I packed.

Cycling the 45 kilometers was fine. I used google maps for navigation (but with the smartphone not visible, just the instructions on my earbuds). I had to stop several times to check the screen to check the instructions and sometimes google came up with weird things. I had it set up for cycle navigation but it still said to take three-quarters of a roundabout to go left while the roundabout allowed me to go from one cycling path on the left of the road to the other. It took me about 2 hours 45 minutes including stops for navigating and stops for drinking, eating and adding some water to nearby trees.

All in all I had a great time. I had my moment of "I am getting too old for this" but that faded and I really enjoyed myself.

List of talks I attended, with links to the place to view it online:

• Everything is an input device (fun with barcodes)
• Honey, let's hack the kitchen: attacks on critical and not-so-critical cyber physical systems
• Radio Amateurism via commercial satelite (no video available), workshop with a demo of the QO-100 broadband transponder
• A Brief History of Automotive Insecurities
• Hacking COVID: Hackers helping the government
• Finding 0days in Enterprise Web Applications
• Audio networks and their security implications
• drand: publicly verifiable randomness explained
• The War in Ukraine: Cyberfront
• Cyber crises and what you can do to face the challenge
• Around the world in 80 networks, Hacking Universities Worldwide. ( ...lessons learned at age 15. ) - Rob Coleman (no video available)
• Payment terminals as general purpose (game-)computers
• A Smart Light Hacking Journey
• Sensor.Community - Global Open Environmental Data Platform
• How do GPS/Galileo really work & how the galmon.eu monitors all navigation satellites

My todo-list for hobby projects has had an entry 'redo maps in sites using leaflet' for a while and on an otherwise calm evening I got around to it. The first thing to upgrade was the recent contact map for PE4KH which shows an overview of places where I had the last 150 contacts plotted on a map, with some details per contact.

I'm not good at javascript programming at all so I just look for examples that come close to what I want and I adjust them until they do what I want. Luckily I found some good geojson examples and I managed to get the points on the map. After a bit of massaging, trying and reading I managed to add the popup with the location. The next and harder bit was adding default and non-default icons. Eventually I got my brain wrapped around the bits needed for that too. After that the test version got deployed to production and you can look at it now.

Documentation and code snippets used:

• Getting started with leaflet
• Getting started in geojson and leaflet
• How to use a custom marker on a geojson layer
• Custom icons in leaflet
• Leaflet reference

The main reasons for switching to leaflet are that google maps was limiting free access to maps although they seem to have mostly reverted this plan and I wanted to promote openstreetmap.

The general conclusion is that sites with maps do need regular maintenance, if hosted leaflet goes away or stops this version, if the rules for using hosted openstreetmap tiles change or if something else happens I have to adapt the site, maybe even quite fast.

De laatste dagen was een deel van de tijd de VDSL weer instabiel en verbrak soms om de 5 minuten. De kabel tussen ISRA punt en modem is wel de verdachte op dit moment.

De standaard oplossing zou natuurlijk zijn om die kabel korter te maken, maar het ISRA punt zit helaas in de kruipruimte en daar wil ik mijn VDSL modem echt niet. Dus er is ongeveer 4 meter kabel nodig van ISRA punt naar meterkast. Op een bepaald moment heb ik daarvoor het bruine aderpaar van een CAT5E kabel gepakt, omdat ik ergens gelezen had dat de twist van dat aderpaar het dichtst bij telefoonkabel komt. Deze kabel heeft wat last van oxidatie, ik heb eerder er ook al een stukje afgehaald vanwege vergaande oxidatie. Misschien moet de hele kabel vervangen worden door een echte KPN telefoonkabel. Ik heb voor de test een keer even een platte kabel zonder twists gebruikt, maar daar werd de uploadsnelheid lager van.

Als tijdelijke oplossing heb ik in de draytek vigor 130 ingesteld dat ik extra 'SNR margin' wil met vdsl snr 10.

Updates 2022-07-18: De instabiliteit bleef vandaag en als we proberen thuis te werken is dat heel gauw heel irritant. Een tijdelijke andere kabel tussen ISRA punt en modem gaf ook geen verbetering, dus rond de lunch maar gebeld met de internet provider Freedom Internet. Die als volgende stap aangaven om de firmware van het modem te upgraden (er was inderdaad een nieuwere versie) en nog eens een factory reset te doen. Bij een draytek Vigor 130 is dat laatste vrij makkelijk door een firmware met .rst extensie te uploaden. Helaas was de recovery procedure Draytek modems weer eens nodig na de eerste upgrade via de webinterface. En het duurde even voordat ik doorhad dat ik het belangrijke woordje binary in die procedure vergat, en dat leverde geen startend modem op. Uiteindelijk gelukt en weer verder...

Maar na een verdere set onderbrekingen was het duidelijk dat het niet verbeterd was en heb ik weer teruggebeld naar Freedom Internet. Na veel ruggespraak, nazoeken en overleg met collega's was de volgende stap dat er nu een monteur gaat komen van KPN Wholesale Broadband Access. Eerste optie op donderdag 21 juli.

Updates 2022-07-21: De KPN monteur heeft uitgebreid gemeten en het ISRA punt vervangen omdat de draadjes in het ISRA punt niet ideaal er in gezet waren. De monteur heeft geprobeerd het ISRA punt te verplaatsen naar de meterkast maar daarvoor is de grondkabel helaas net te kort. Na het vervangen heeft de monteur nog uitgebreid gekeken naar alle lijnstatistieken, zag dat DLM niet aanstaat op deze lijn terwijl hij dat wel verwachtte maar dat kan een keuze zijn van de provider.

Een van de dingen die de monteur zich nog afvroeg was wanneer er glasvezel zou komen naar dit adres. Dat vraag ik me ook regelmatig af, maar ik hoor niets over plannen. Open Dutch Fiber is aan de overkant van het spoor bezig in Tuindorp. Maar geen van de fiber aanbieders laat iets weten over toekomstplannen tot dat er een echt project is om een bepaalde wijk aan te gaan sluiten.

Updates 2022-07-22: De volgende ochtend blijken er toch weer vergelijkbare onderbrekingen te zijn. Freedom mailde pro-actief dat ze van hun kant ook de problemen zagen. Een optie is nog om het te proberen met een ander modem.

Updates 2022-07-28: Terug van MCH2022 blijkt alles sinds de avond 22 juli stabiel en zonder onderbrekingen te werken. De tellers voor fouten blijven sinds de 25e stilstaan. Pas nu ik zelf actief ben op de radio is er weer een korte onderbreking.

Friday I had the day off and a plan together with Kees PA5Z to visit the location Trintelhaven again, just like we visited the location Trintelhaven in the summer of 2019.

This time the plan was to test some different antennas and make morse contacts. Driving there wasn't too big of a problem although you really have to use navigation to get through Lelystad, it's like through-traffic from the main highway (A6) to Enkhuizen isn't really promoted.

We got there fine, looked for a nice spot, found all the work machines we saw on the previous visit gone so there was a nice spot again. We selected a secluded field not to close to someone working on a boat, far away from everything else.

Endfed antenna set up at Trintelhaven

We set up my endfed antenna with one end up in the trees and the other end supported by a metal pole. On testing this antenna worked fine again. I redid all the soldered connections in it after it failed me a few weeks ago.

I called CQ in the 20 meter band in a spot where one can usually find slow morse and got some contacts with nice people in the log. One with SM6RWJ in Sweden, one with WB2YVY Kurt in the state of New York in the US and one with LA9FG Nol in Norway near Aalesund.

Kees PA5Z en Koos PE4KH behind the radio

Kees also made some contacts. His nicest contact was with SK6SAQ the amateur radio station at the World Heritage Grimeton radio station. After a few morse contacts the radio Kees brought stopped working, it switched off and restarted when trying to transmit morse. It wasn't very clear what caused this.

As planned we took turns on the antenna sending morse, while both listening for answers and writing down the callsigns and the replies that came, including first names and weather reports: it was cloudy in Norway.

A nice day out. Sending standard messages and writing down what was coming back is getting easier after all our morse training!

More than 11 years ago I wrote about the Magna Carta card systems for access / payment and the use of the mifare classic (in Dutch). I found a strong statement on the Magna Carta website back then that using mifare classic for stored value was a really bad idea, since the encryption on the card is broken.

It's now 2022 and I read MIFARE Cracking about a company using a mifare classic for stored value which shows the steps from discovering what type of card that company uses to the option of manipulating the stored monetairy value on the card.

Found via Travis Goodspeed on twitter - A practical article on cloning a Mifare Classic employee badge to tamper with the snack machine.

I created a flickr album Iceland 2022 - Our trip to Iceland in April/May 2022 and linking to the pictures from the right report was still kind of hard because it's a complicated bit of html with repetitions and chances of errors.

The solution: make the computer help me. The flickr API allows me to fetch data about an album and about the pictures in that album, so I spent an evening writing some perl to get links to all the pictures in the album with thumbnails.

Now most days of Complete reports of our trip to Iceland have been enhanced with pictures.

This weekend was the IARU HF World Championship contest and I participated after fully planning this in advance. I made sure my contest logger was set up and communicating with the remote radio and its morse keyer in advance.

I participated on the 10, 15 and 20 meter bands. The original plan was to also include 40 and maybe 80 but there was enough to contact on 10 and 15 on Saturday evening, so I only got around to the 20 meter band on sunday. In total 182 contacts: 20 in SSB (speech) and 162 in CW (morse).

Band   160   80   40   20   15   10
QSO's    0    0    0   58   83   41
Mult     0    0    0   24   33   16
                                   
Pts: 586  Mul: 73 Score: 42778     

I managed to make a few contacts outside Europe, not a lot of real DX.

Calculation when entering the log: Raw Score: 453 Qpts x 73 Mults = 33,069 (181 QSOs) so there is a difference in opinion between TLF and the ARRL contest website. The difference in number of contacts is due to one duplicate. The difference in Qpts (QSO points) is due to a difference in the scoring rules. As the ARRL contest website is up to date with the current rules I think they are right and I need to have a look at the TLF ruleset.

Hearing and understanding the morse went ok, I don't think I have a high number of errors.

The logic analyzer circuit I ordered came in today with the test leads. Both the circuit and the test leads have pins so I need something to connect those two. So the crate with PC cables was ransacked and a floppy drive cable is now connecting the logic analyzer and the test leads.

The logic analyzer shows up in linux as usb device:

Bus 002 Device 008: ID 1d50:608c OpenMoko, Inc. Fx2lafw

Finding software was quite easy: pulseview indeed works out of the box, complete with support for this logic analyzer.

I had a look around for something to analyze and finally settled on the ESP32 based NTP clock because that's still on a breadboard and signals are available. I can see the bits flowing between the ESP32 microcontroller and the display module.

I'm still seeing some bits come in on unconnected testleads so I'm not sure I am doing everything right. But it's a start!

A few days ago I noticed some interesting messages in the apcupsd log:

2022-07-04 10:14:15 +0200  Battery disconnected.
2022-07-04 10:16:24 +0200  Battery reattached.
2022-07-04 10:19:53 +0200  Battery disconnected.
2022-07-04 10:20:40 +0200  Battery reattached.

Checking the UPS statistics showed me the battery charge was dropping to about 7 % of the capacity while the mains power was available. Since the battery was over 5 years old I ordered a new one to replace it.

This battery was scheduled to arrive Wednesday at the start of the afternoon and I wanted to do an upgrade of the Linux distribution on the main homeserver conway anyway because devuan ascii is already 'oldoldstable' (but still getting updates).

The homeserver uses 2 disks with the main lvm volume in a raid-1. The /boot and /boot/efi filesystems are mirrored by hand with the idea to end with a working boot even when 1 disk is missing.

After the shutdown and replacing the UPS battery I switched the server on again and I was greeted by a grub prompt and nothing to boot. After a few tries I got the system booting again, after that I went searching for what went wrong. Eventually I found out the file /boot/efi/EFI/devuan/grub.cfg pointed at a missing filesystem. I found out the best way to fix this is with

# dpkg-reconfigure grub-efi-amd64

both with /dev/sda and /dev/sdb filesystems on /boot and /boot/efi.

For the first time in years I was staying in a hotel again for one night. The key for the hotel was a creditcard sized plastic card so I assumed immediately it was an RFID based card.

Years ago I would have needed my linux laptop and the touchatag NFC reader to understand more about the keycard, but we're in some form of the future now, so I used NFC taginfo by NXP on my phone and held the keycard up to the phone.

The taginfo app made the happy noise and told me it was an NXP mifare classic card. The app even told me most sectors had a default key of FF:FF:FF:FF:FF:FF. One sector was not accessible due to a different key but with mfoc (Mifare Classic offline cracker) or one of the other attacks on the Mifare classic I could probably get access to that sector.

So in theory with something like the proxmark I could clone keycards of other visitors. Or clone the keycard of the cleaning crew which gives a lot more access.

Update: A bit of searching finds this: Researchers Find Way to Create Master Keys to Hotels - F-Secure Blog. I don't know if the lock I looked at is the same system as the system in this article.