2025 Component Abuse Challenge: The VIA Makes Noise, Again

In the days of 8-bit home computing, the more fancy machines had sound chips containing complete synthesizers, while budget machines made do with simple output ports connected to a speaker — if they had anything at all. [Normal User] appears to be chasing the later route, making PCM sound by abusing the serial port on a 6522 VIA chip.

A serial port is when you think about it, a special case of a one-bit output port. It’s designed for byte data communication but it can also carry a PCM data stream. We’ve seen this used with microcontrollers and peripherals such as the I2S port plenty of times here at Hackaday, to produce such things as NTSC video. The 1970s-spec equivalent might not be as fast as its modern equivalent, but it’s capable of delivering audio at some level. The machine in question is a Ben Eater breadboard 6502 with a World’s Worst Video Card, and as you can hear in the video below the break, it’s not doing a bad job for the era,

If you think this hack sounds a little familiar then in a sense you’re right, because Ben Eater himself made noises with a 6522. However it differs from that in that he used the on-board timers instead. After all, the “V” in “VIA” stands for “versatile”.

youtube.com/embed/0glEfLZCwmc?…

hackaday.com/2025/11/14/2025-c…

WWII Secret Agents for Science

We always enjoy [History Guy]’s musing on all things history, but we especially like it when his historical stories intersect with technology. A good example was his recent video about a small secret group during the Second World War that deployed to the European Theater of Operations, carrying out secret missions. How is that technology related? The group was largely made of scientists. In particular, the team of nineteen consisted of a geographer and an engineer. Many of the others were either fluent in some language or had been through “spy” training at the secret Military Intelligence Training Center at Camp Ritchie, Maryland. Their mission: survey Europe.

We are spoiled and enjoy several different GPS systems that can pinpoint our position quickly and easily, but that’s a modern invention. In the old days, everything came down to a geodetic reference point, usually an iron rod or some form of marker with a well-known position. Using surveying equipment, you could position other locations by referring to the reference points.

You might think that the exact location of a city isn’t that important if you are invading it. But, as the [History Guy] points out, sending artillery over the horizon being off even a little bit can have disastrous consequences. Of course, other countries had good references, but they were often not made available for obvious reasons.

The Army sent out a call for “geodesists.” They found Floyd Huff, a Civil Engineer with the requisite experience. They made him a major, and he led a secret band through liberated areas right behind the front line. They carried about 1,800 pounds of cameras and a database of both what was known and locations like libraries and schools that might have enemy geodetic data.

It paid off. Between talking to captured soldiers, finding sympathetic academics, and finding bombed-out libraries, they were able to use their cameras to make microfilm to get better data to the front lines immediately. They even found the entire database from the German Army, but had to mount a significant operation to secure it before the Russians took over the city. They even captured high-tech equipment the Germans used to change aerial photographs into topological maps.

Some of the techniques these secret scientists developed have had far-reaching consequences on mapping. The video explains it, and, as usual, it is fun to watch and educational. If you prefer to read, you might enjoy this older article from The Smithsonian.

Like many secret agents, they aren’t well known because — well, you know — they work in secret. Huff is featured in the — we aren’t making this up — National Geospatial Intelligence Hall of Fame.

With modern tech, it is easy to forget what a technical accomplishment it is to know exactly where things are. Of course, GPS is supremely complicated, but not for us, its users.

youtube.com/embed/l6ciUozP2vI?…

hackaday.com/2025/11/14/wwii-s…

Hackaday Podcast Episode 345: A Stunning Lightsaber, Two Extreme Cameras, and Wrangling Roombas

It’s a wet November evening across Western Europe, the steel-grey clouds have obscured a rare low-latitude aurora this week, and Elliot Williams is joined by Jenny List for this week’s podcast. And we’ve got a fine selection for your listening pleasure!

The 2025 Component Abuse Challenge has come to an end, so this week you’ll be hearing about a few of the entries. We’ve received an impressive number, and as always we’re bowled over by the ingenuity of Hackaday readers in pushing parts beyond their limits.

In the news is the potential discovery of a lost UNIX version in a dusty store room at the University of Utah, Version 4 of the OS, which appeared in 1973. Check out your own stores, for hidden nuggets of gold. In the hacks, we have two cameras at the opposite end of the resolution spectrum, but sharing some impressive reverse engineering. Mouse cameras and scanner cameras were both a thing a couple of decades ago, and it’s great to see people still pushing the boundaries. Then we look at the challenge of encoding Chinese text as Morse code, an online-upgraded multimeter, the art of making lenses for an LED lighting effect, and what must be the best recreation of a Star Wars light sabre we have ever seen. In quick hacks we have a bevvy of Component Abuse Challenge projects, a Minecraft server on a smart light bulb, and a long term test of smartphone battery charging techniques.

We round off with a couple of our long-form pieces, first the uncertainties about iRobot’s future and what it might mean for their ecosystem — think: cheap hackable robotics platform! — and then a look at FreeBSD as an alternative upgrade path for Windows users. It’s a path not without challenges, but the venerable OS still has plenty to give.

As always, you can listen using the links below, and we’ve laidout links to all the articles under discussion at the bottom of the page.

html5-player.libsyn.com/embed/…

Download our finest MP3 right here.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

• iTunes
• Spotify
• Stitcher
• RSS
• YouTube
• Check out our Libsyn landing page

Episode 345 Show Notes:

News:

• Component Abuse Challenge
• Have They Found A Complete UNIX V4?

What’s that Sound?

• Think you know what the sound is? Put your metaphorical two cents in here.

Interesting Hacks of the Week:

• Camera Capabilities Unlocked From A Mouse
  
  • Optical Mouse Based Scanner
  • DIY Optical Sensor Breakout Board Makes DIY Optical Mouse

  
  

• Medium Format, 3 GigaPixel Camera Puts It All On The Line (Sensor)
• Morse Code For China
  
  • UTF-8 Is Beautiful
  • UTF-8 – “The Most Elegant Hack”
  • Reproduced And Recovered: The First Chinese Keyboard-based MingKwai Typewriter

  
  

• Screen-Accurate Lightsaber As A Practical Effect
• Cheap Multimeter Gets Webified
• An LED Projector As A Lighting Effect

Quick Hacks:

• Elliot’s Picks:
  
  • RP2040 From Scratch: Roll Your Own Dev Board Magic
  • Running A Minecraft Server On A WiFi Light Bulb
  • Nest Thermostat: Now 100% Less Evil
  • Testing Whether Fast Charging Kills Smartphone Batteries, And Other Myths

  
  

• Jenny’s Picks:
  
  • 2025 Component Abuse Challenge: Dawg Gone LED Tester
  • 2025 Component Abuse Challenge: Glowing Neon From A 9 V Relay
  • 2025 Component Abuse Challenge: The Slip Ring In Your Parts Bin
  • Have A Slice Of Bumble Berry Pi

  
  

Can’t Miss Articles:

• If IRobot Falls, Hackers Are Ready To Wrangle Roombas
• Moving From Windows To FreeBSD As The Linux Chaos Alternative

hackaday.com/2025/11/14/hackad…

This Week in Security: Landfall, Imunify AV, and Sudo Rust

Let’s talk about LANDFALL. That was an Android spyware campaign specifically targeted at Samsung devices. The discovery story is interesting, and possibly an important clue to understanding this particular bit of commercial malware. Earlier this year Apple’s iOS was patched for a flaw in the handling of DNG (Digital NeGative) images, and WhatsApp issued an advisory with a second iOS vulnerability, that together may have been used in attacks in the wild.

Researchers at Unit 42 went looking for real-world examples of this iOS threat campaign, and instead found DNG images that exploited a similar-yet-distinct vulnerability in a Samsung image handling library. These images had a zip file appended to the end of these malicious DNG files. The attack seems to be launched via WhatsApp messaging, just like the iOS attack. That .zip contains a pair of .so shared object files, that are loaded to manipulate the system’s SELinux protections and install the long term spyware payload.

The earliest known sample of this spyware dates to July of 2024, and Samsung patched the DNG handling vulnerability in April 2025. Apple patched the similar DNG problem in August of 2025. The timing and similarities do suggest that these two spyware campaigns may have been related. Unit 42 has a brief accounting of the known threat actors that could have been behind LANDFALL, and concludes that there just isn’t enough solid evidence to make a determination.

Not as Bad as it Looks

Watchtowr is back with a couple more of their unique vulnerability write-ups. The first is a real tease, as they found a way to leak a healthy chunk of memory from Citrix NetScaler machines. The catch is that the memory leak is a part of an error message, complaining that user authentication is disabled. This configuration is already not appropriate for deployment, and the memory leak wasn’t assigned a CVE.

There was a second issue in the NetScaler system, an open redirect in the login system. This is where an attacker can craft a malicious link that points to a trusted NetScaler machine, and if a user follows the link, the NetScaler will redirect the user to a location specified in the malicious link. It’s not a high severity vulnerability, but still got a CVE and a fix.

Worse than it Looks

And then there’s the other WatchTowr write-up, on Monsta FTP. Here, old vulnerabilities continue to work in versions released after the fix. The worst one here is an unauthenticated RCE (Remote Code Execution) that can be pulled off by asking the server nicely to connect to a remote SFTP server and download a file. In this case, the specified path for saving that file isn’t validated, and can be written anywhere to the Monsta FTP filesystem. Instant webshell. This time it did get fixed, within a couple weeks of WatchTowr sending in the vulnerability disclosure.

Imunify AV

Antivirus software Imunify just fixed an issue that threatened a few million servers. Imunify is an antivirus product that scans for malicious code. It sounds great. The problem is that it worked to deobfuscate PHP code, by calling an executeWrapper helper function. The short explanation is that this approach wasn’t as safe as had been hoped, and this deobfuscation step can be manipulated into running malicious code itself. Whoops.

Patchstack reported on this issue, and indicated that it had been publicly known since November 4th. Patches have since been issued, and a simple message has been published that a critical security vulnerability has been fixed. There is a PoC (Proof of Concept) for this vulnerability, that would be trivial to develop into a full webshell. The only challenge is actually getting the file on a server to be scanned. Either way, if your servers run Imunify, be sure to update!

IndonesianFoods

There’s another NPM worm on the loose, and this one has quietly been around for a couple years. This one is a bit different, and the “malicious” packages aren’t doing anything malicious, at least not by default.

[Paul McCarty] first spotted this campaign, and gave it the name “IndonesianFoods”, inspired by the unique names the fake packages were using. It appears that a handful of malicious accounts have spent time running a script that generates these fake packages with unique names, and uploads them to NPM. Downloading one of these packages doesn’t run the script on the victim machine, and in fact doesn’t seem to do anything malicious. So what’s the point?

Endor Labs picked up this thread and continued to pull. The point seems to be TEA theft. That’s the Blockchain tech that’s intended to reward Open Source project and contributions. It’s yet another abuse of NPM, which has had a rough year.

Rusty Sudo

Canonical made a bold decision with Ubuntu 25.04, shipping the uutils Rust rewrite of coreutils and sudo-rs. That decision was controversial, and has proven to be a cause of a few issues. Most recently, the sudo-rs utility has made news due to security vulnerabilities. We know the details on a few of the issues fixed in this update of those, CVE-2025-64170. It’s a quirk when a user types a password into the prompt, but never presses return. The prompt times out, and the typed characters are echoed back to the terminal.

Another issue doesn’t have a CVE assigned yet, but is available as a GitHub Security Advisory, and the patch is published. This one has the potential to be an authentication bypass. Sudo has the feature that tracks how long it has been since the user has last authenticated. The flaw was that this state was leaking between different users, allowing a login by one user to count as a login for other users, allowing that password skip.

Bits and Bytes

And finally, there’s a bit of good news, even if it is temporary. Google has taken action against one of the larger SMS scam providers. The group operates under the name Lighthouse, and seems to use normal cloud infrastructure to run the scams, simply flying under the radar for now. Google has combined legal action with technical, and with any luck, law enforcement can join in on the fun.

hackaday.com/2025/11/14/this-w…

La Wayback Machine “delle anime” sta per arrivare. E anche le polemiche

Molti di noi sono cresciuti con Hiroshi Shiba, di Jeeg robot d’acciaio che parlava con il defunto padre, il Professor Senjiro Shiba, scienziato e archeologo all’interno di un grande elaboratore.

In un futuro distopico – ma molto vicino – le persone defunte potranno parlare con i defunti, che saranno archiviate e indicizzate in un grande “archivio delle anime*, come una grande Wayback machine, ma per i defunti.

Lo scandalo dei “fantasmi” digitali è divampato di nuovo. Nel 2020, Kanye West regalò a Kim Kardashian un ologramma del suo defunto padre, Rob Kardashian, per il suo compleanno: all’epoca, questo gesto sembrò un regalo futuristico riservato solo alle celebrità.

Ora, diversi anni dopo, il mondo dell’intelligenza artificiale si sta muovendo con sicurezza verso un futuro in cui queste cose saranno accettate come parte della vita quotidiana.

La startup di Los Angeles 2Wai ha scatenato un’ondata di polemiche dopo aver lanciato un’app che permette agli utenti di creare avatar digitali interattivi di parenti defunti. L’azienda ha fatto subito notizia: il co-fondatore Calum Worthy ha pubblicato un video che è diventato virale sui social media nel giro di poche ore.

In questo video, una donna incinta parla al telefono con un’incarnazione artificiale della sua defunta madre. La scena fa poi un salto in avanti di dieci mesi: la “nonna” digitale legge una favola della buonanotte al bambino. Qualche anno dopo, il bambino, ormai scolaretto, discute con lei della strada per tornare a casa. La scena finale mostra un uomo adulto che informa la sua parente virtuale che diventerà bisnonna.

Sullo schermo appare lo slogan: “Con 2Wai, tre minuti possono durare per sempre”. Worthy, nei commenti, ha affermato che la sua azienda sta creando un “archivio vivente dell’umanità”, un social network basato sugli avatar. Ha anche formulato la principale domanda retorica del progetto: “E se le persone che abbiamo perso potessero far parte del nostro futuro?”

L’app è ora disponibile sull’App Store. Permette agli utenti di creare un cosiddetto HoloAvatar, un sosia digitale che, secondo gli sviluppatori, “ti assomiglia e parla come te, e condivide i tuoi ricordi“. Worthy ha incoraggiato gli utenti a provare la versione beta e ha sottolineato che una versione per Android sarà disponibile in seguito.

Gli utenti dei social media hanno immediatamente tracciato un parallelo con l’episodio “Return to Me” di Black Mirror, in cui una donna crea una copia IA del suo partner defunto e perde gradualmente il contatto con la realtà. Molti commentatori hanno definito il video di 2Wai un “incubo a occhi aperti“, una “tecnologia demoniaca” e hanno persino chiesto che tale tecnologia venisse “distrutta“.

La scena in cui un bambino instaura un legame emotivo con una versione digitale della nonna ha causato particolare tensione, sollevando preoccupazioni sul fatto che tali servizi possano distorcere la memoria, il dolore e il concetto stesso di relazioni familiari.

I sostenitori del progetto, al contrario, lo vedono come un modo per preservare la voce , il modo di parlare e le storie personali dei membri della famiglia per i decenni a venire. Vedono la tecnologia come un’opportunità per tramandare i ricordi di generazione in generazione.

Ma per ora, il dibattito rimane estremamente polarizzato. Alcuni credono che tali servizi inaugureranno una nuova forma di memoria digitale. Altri ritengono che questi deepfake rischino di offuscare il confine tra memoria e simulazione, oltre ad avere un impatto negativo sulla salute mentale degli individui.

Come dimostra la reazione al video, la società non ha ancora deciso dove tracciare il confine tra eredità digitale e interferenza con i sentimenti umani. Ma una cosa è chiara: l’intelligenza artificiale sta sempre più invadendo la sfera intima e tali strumenti solleveranno inevitabilmente nuove questioni psicologiche ed etiche per la società.

L'articolo La Wayback Machine “delle anime” sta per arrivare. E anche le polemiche proviene da Red Hot Cyber.

Android Developer Verification Starts as Google Partially Retreats on Measures

In a recent blog post Google announced that the early access phase of its Android Developer Verification program has commenced, as previously announced. In addition to this new announcement Google also claims to be taking note of the feedback it has been receiving, in particular pertaining to non-commercial developers for whom these new measures are incredibly inconvenient. Yet most notable is the ’empowering experienced users’ section, where Google admits that to developers and ‘power users’ the intensive handholding isn’t required and it’ll develop an ‘advanced flow’ where unverified apps can still be installed without jumping through (adb) hoops.

What this new option will look like, and how it’ll differ from the current warning pop-up when installing an APK not via the Play Store remains to be seen. Either way, it highlights the impossible balance that Google is trying to strike between a simultaneously open ecosystem and a high-security one. A problem with a central software repository is that while it does provide a lot of convenience for end users, ensuring that all software in it is vetted and safe is a tough one.

In the case of something like the Debian or FreeBSD software repositories, these are quite locked down and with no random developer getting their software in without some serious work, whereas the very open NPM and Python repositories are practically overrun with malware. Here Google has to choose and pick its battles, with the scenario of scammers making a victim download a fake ‘verification app’ clearly being front and center on their mind. The problem here being of course that this is trying to fix a social engineering issue with technology, which only gets you so far and risks immense damage in the process.

For developer types, Google still only distinguishes between commercial developers and students/hobbyists, with the latter developing for a ‘small group’, making one wonder how OSS software with potentially very large userbases will be treated. Will they have to go through the whole ‘submit government ID scan’ and publishing of personal contact information on the app details page, same as for a commercial app?

Either way, it seems like good progress at least that the option of distributing APKs via alternate app stores as well as places like GitHub will be preserved. Telling users to just mash the ‘Ok’ button a few times on scary dialogs is significantly more straightforward than instructing them on how to push your app onto their Android device via adb would be. In fact, most users probably won’t need any special encouragement to do so.