الوسم: flaw

  • Scientists Find Flaw In Stuck Rovers With Free Software

    Scientists Find Flaw In Stuck Rovers With Free Software

    Space missions are incredibly complex and costly endeavors, with many variables that can go wrong. This is especially true for remote-controlled robots and vehicles exploring extraterrestrial surfaces like the Moon or distant planets. Even a small issue, such as a rover getting obstructed, can jeopardize the entire mission or lead to its abandonment.

    In 2005, NASA’s Mars Exploration Rover Opportunity became embedded in loose sand, requiring six weeks of painstaking, inch-by-inch adjustments by team experts at the Jet Propulsion Laboratory to free it. More recently, the Perseverance rover encountered a similar challenge when its drill bit became stuck, but this situation was ultimately resolved.

    However, not every incident ends happily. In 2009, the Spirit rover found itself stranded on a slope in a location from which it could never be rescued. The harsh Martian winter further complicated rescue efforts, and the mission was officially terminated two years later. Such mishaps may soon become less frequent thanks to advancements in understanding and technology.

    Researchers at the University of Wisconsin–Madison identified a critical flaw in how these rovers are tested on Earth. Typically, testing takes place in desert-like environments designed to mimic the dry conditions found on the Moon or Mars, including the reduced gravity on these celestial bodies. But these tests often neglect to account for the effect of gravity on loose materials like sand.

    The UW-Madison team pointed out that traditional testing methods overestimate a rover’s ability to navigate real extraterrestrial terrain. They emphasize that an accurate prediction of rover movement requires understanding how it will perform under the actual low-gravity conditions of space, which influence how sand and rocks behave—particularly how soft terrain can cause a rover to get stuck.

    The team used open-source software called Chrono for their analysis. This tool is commonly employed to simulate the off-road capabilities of military vehicles in addition to robotic exploration gear. Their findings, published in the Journal of Field Robotics, highlight that Earth’s gravity exerts a stronger pull on loose particles than on the Moon or Mars, resulting in different terrain interactions that can lead to rover immobilization on other planets.

    This research is part of a broader effort to improve space exploration safety. The same team is also working on simulation models for NASA’s VIPER mission, which was designed to search for water and other resources on the Moon’s harsher side—though the project was canceled in 2024.

    The team’s work demonstrated that the discrepancy in rover performance predictions stems from differences in gravitational pull and terrain dynamics. They found that Earth’s higher gravity makes sand particles more rigid, and the Moon’s surface is softer, causing greater shifting under the wheels and reducing grip.

    Interestingly, the software behind this research is widely used in various fields. Its applications extend beyond planetary exploration, including vehicle design for the U.S. Army, projects at NASA’s Jet Propulsion Laboratory, and even tiny mechanical systems for watches. This versatility underscores the importance of accurate simulation in advancing both space technology and terrestrial engineering.

    By refining testing procedures with more realistic models that consider planetary gravitational differences, engineers aim to improve rover designs and mission success rates. This progress could lead to fewer instances of rovers becoming stuck, ultimately enabling more efficient and safer exploration of our solar system’s distant worlds.

  • Google Fixes USB Flaw That Exposed Over A Billion Androids

    Google Fixes USB Flaw That Exposed Over A Billion Androids

    In early February, Google released its latest Android Security Bulletin, which outlines various security vulnerabilities that have been addressed to enhance the platform’s protection. Typically, these vulnerabilities are disclosed once they have been resolved, although there are exceptions.

    This month’s bulletin highlighted a particularly critical kernel-level vulnerability, designated CVE-2024-53104, which was still being actively targeted at the time the bulletin was published. As noted in the release information, “There are indications that CVE-2024-53104 may be under limited, targeted exploitation.”

    The issue was initially brought to light by experts from Amnesty International, who characterized it as an “out-of-bound write in the USB Video Class (UVC) driver.” Since this is a kernel-level vulnerability, it poses a threat to over a billion Android devices, regardless of their brand.

    As a zero-day exploit, the details of this vulnerability are known primarily to the attackers, who may be able to continue exploiting it until security professionals identify it, collaborate with the platform’s team to develop a fix, and subsequently distribute that fix to affected devices. Additionally, two other vulnerabilities, CVE-2024-53197 and CVE-2024-50302, have also been patched at the kernel level but not yet at the operating system level by Google.

    ### The Swath of Impact

    The impact of this vulnerability stretches across the entire Android ecosystem, with USB interfaces serving as the attack vector. This entails exploits targeting the Linux kernel USB drivers, allowing unauthorized individuals to bypass Lock Screen protections and gain privileged access to the phone through a USB connection.

    In a notable case, a Cellebrite tool was purportedly utilized to unlock the phone of a Serbian student activist, gaining forbidden access to the device’s data. The Cellebrite UFED device was used by law enforcement on the student’s phone without their knowledge or consent.

    Amnesty highlights that the deployment of tools like Cellebrite, often misused to target journalists and activists, lacked legal authorization. The device involved was a Samsung Galaxy A32, and the Cellebrite equipment successfully circumvented its Lock Screen security to achieve root access.

    The report stresses, “Android vendors must urgently enhance security features to guard against threats from untrustworthy USB connections on locked devices.” This isn’t the first time Cellebrite has drawn attention for ethical issues related to surveillance.

    The company markets its forensic analysis tools to various law enforcement and federal agencies across the U.S. and beyond, enabling them to access devices for data extraction. In 2019, Cellebrite claimed it could unlock any Android or Apple device with its Universal Forensic Extraction Device, but this has raised significant concerns regarding privacy and ethical practices when authorities misuse technology for surveillance or harassment of whistleblowers, journalists, and activists.

    In response to these security challenges, Apple recently tightened security measures in the iOS 18.1 update, aimed at curbing unauthorized access to locked smartphones and safeguarding sensitive information from being compromised.

  • Apple Still Needs To Fix Major Security Issue In Find My Network

    Apple Still Needs To Fix Major Security Issue In Find My Network

    The Find My network from Apple is a potent resource for tracking the whereabouts of your devices. However, it currently has a significant security flaw that remains unaddressed. Researchers from George Mason University found that this network can be manipulated to trace nearly any Bluetooth device—not just AirTags or iPhones—by leveraging both Apple’s system and a device’s Bluetooth address.

    “It’s akin to turning any laptop, smartphone, or even gaming console into an Apple AirTag without the owner’s knowledge,” explained lead researcher Junming Chen. “And the hacker can execute this from thousands of miles away with a modest investment.”

    To grasp the nature of the exploit, one must understand the inner workings of the Find My network. For instance, an AirTag emits a Bluetooth signal to nearby Apple devices, which then sends that information anonymously to the Apple Cloud. The crux of the exploit is rooted in this anonymity.

    Apple's Find My Devices website showing a list of devices against a background map.
    Jesse Hollington / Digital Trends / Apple

    The researchers, capitalizing on the cryptographic nature of the data, managed to create a key that adapts dynamically, which they termed “nRootTag.” Alarmingly, this key boasts a 90% success rate.

    The team conducted tests on a diverse array of devices, achieving disconcerting results. They managed to locate a computer within a 10-foot radius and even traced an airplane’s flight path and number by monitoring a gaming console that a passenger brought aboard.

    This experiment underscores the capabilities of Apple’s Find My network but also raises concerns about how easily malicious individuals could access private data. There have been instances where AirTags were used for unauthorized tracking, prompting Apple to enhance security measures in upcoming AirTag iterations. However, nRootTag extends beyond just AirTags, enabling the tracking of VR headsets, smart TVs, and various other devices with alarming ease.

    Find My app icon in iOS 15.
    Apple

    Qiang Zeng, another researcher involved in the study, pointed out a particularly troubling aspect of the exploit: “While it’s concerning if someone hacks into your smart lock, it becomes even more alarming if they can simultaneously pinpoint its location. The method we’ve developed enables this.”

    In July 2024, the research team notified Apple about the vulnerability, which the company has acknowledged in its update notes. However, a fix has yet to be released. Addressing this flaw, which is integral to the Find My network’s fundamental operation, may require time—potentially years, according to the researchers.

    In the meantime, Chen suggests ensuring all devices and software are updated regularly and being vigilant about any applications requesting Bluetooth access, particularly those that don’t necessitate it.