6 ms·
My business card runs Linux and Ultrix (2022)
- SushiHippie 3y agoDoes anyone know more of these 'PCB business cards' projects? For example mitxela did a business card that acts as a stylophone https://mitxela.com/projects/stylocard https://mitxela.com/projects/stylocard
- hathawsh 3y agoFirst thought I had: Very cool! Second thought: If I received this card, I would think twice about attaching a homemade USB device to anything. Who knows what it might do? [1] Third thought: I should let people I know that this is becoming possible. Fourth thought: Wait a minute, any USB device is potentially risky, not just homemade ones. Carry on! .. 1. https://usbkill.com/ https://usbkill.com/
- JohnFen 3y ago> If I received this card, I would think twice about attaching a homemade USB device to anything. I have a Raspberry Pi devoted to the purpose of plugging unknown USB devices into in order to do a security check on them. If it kills the R-Pi, no big deal. If it doesn't, then you have the power of Linux to interrogate the device with and spot suspicious behavior.
- kid64 3y agoThat's interesting, may I ask how you'd typically perform the interrogation?
- an_aparallel 3y agoim interested too... im guessing there's some Kali linux utils for doing just this?
- JohnFen 3y agoKali is convenient in that it has security tools preinstalled (it's what I use in my pentesting gear), but this can be done with any distro. Primarily what I'm looking for is if the capabilities of the device match what I expect them to be (does this flash drive -- or even just a random USB cable -- also represent itself as a user input device?), and to spy on the USB packets for things like keystroke replay, bitstreams that don't match what would be expected (virii installations, unusual behavior if the storage device thinks that it is being booted from, etc.) It is not comprehensive. Just a sanity check.
- hathawsh 3y agoIf I were paranoid, I might be concerned that the USB device would detect when it's plugged in to a small device like a Raspberry Pi and only launch its attack when it's plugged in to a more valuable target. Is there some way to mitigate that?
- bpye 3y agoDifferent operating systems also have subtle differences in enumeration - I don’t think there is a great way to mitigate that.
- lcnPylGDnU4H9OF 3y ago> then you have the power of Linux to interrogate the device with and spot suspicious behavior Ideally, you’d find the malicious payload. It’s probably not hidden so well that it can’t be found by a security researcher.
- JohnFen 3y agoTrue, if I care. I use the R-Pi as a screening method, not really as the means to dig into something malicious and analyze it in detail. I have other tools for that. My reasoning for using the R-Pi is that it's disposable, so if the USB device turns out to be an electrical USB-killer, it doesn't kill any hardware that really matters to me.
- JohnFen 3y ago> Is there some way to mitigate that? Against a very sophisticated attacker? Maybe not, but it doesn't matter for my purposes. My concern is the most likely kinds of attacks, which are not terribly sophisticated. It's really more of a sanity check than a comprehensive security audit. No security can ever be 100% effective. Like all security measures, this is just one layer intended to cover attacks I am most likely to be exposed to. In other words, if I'm protecting against governments and other well-funded entities or skilled and determined hackers, I wouldn't be using this alone. I'd be using it in conjunction with other security processes, such as not attaching unknown USB devices to my systems at all, or at least not to ones that matter or aren't permanently isolated from my other machines.
- nine_k 3y agoIwonder if a $15 USB hub could serve as an adequate protection against electric shenanigans.
- DistractionRect 3y agoWho says the hub isn't the one hosting the shenanigans?
- squarefoot 3y agoIf one buys it from a reputable source it should be safe. Besides, who says that the binary firmware blobs in the computer don't already contain suspicious code?
- nonrandomstring 3y agoA student of mine was researching "vendor malware" [0] she decided to order as many random, dodgy USB devices as could be found on the internet to see what percentage of them were loaded with horrors. We settled on a CRU Wiebetech write blocker and a minimal sandboxed distro (that could reboot to a clean slate in a couple of seconds) with little more than a kernel for which we could activate and deactivate USB modules. Conclusions: USB is terrifying! :) Buying USB things in the internet is even more scary!! [0] https://www.solent.ac.uk/degree-shows/students/helen-plews-2 https://www.solent.ac.uk/degree-shows/students/helen-plews-2
- pests 3y agoInteresting. I expected already used and returned devices but seeing hidden possible firmware and encrypted blobs was a surprise.
- epcoa 3y agoDon’t have the time to dissect the linked PDF, but it has numerous issues including methods that are imprecise, misapplied or simply wrong. It needs a pretty extensive review by an expert. The file signature listings shown on page 80 are most likely spurious (false matches). The first give away is why there would be over 2000 microcode artifacts, the next is that all of the inspected fields are bogus, including the size field (some in the GBs). In theory you could purposefully obfuscate that, but then why would you carry any tell of microcode at all. Much more likely this is just patterned data that happens to match that file magic. Anybody with experience with binwalk knows how common this is. Same goes for the mcrypt(?) headers. Blowfish 448 CBC 8-bit happens to be all 0s. Another very common false positive (matches \x00m\x02). Also look at the offsets carefully. Seems more like a match confusion. As for encrypted appearing data at all, not too surprising if someone is selling used drives and naively wiped them. But it isn’t clear that encrypted vs compressed data was identified. There’s also a fundamental misunderstanding of what a write blocker is/does repeated. "Results indicated the presence of firmware ... in the machine code of the unallocated spaces of the storage device.". Machine code of the unallocated spaces makes no sense. In general: microcode attacks are sophisticated attacks. Anybody carrying these out is unlikely to leave such an obvious smoking gun. Not saying impossible, but it would give any serious researcher pause to scrutinize their work. Also not saying you won’t get shitty crap from random sellers and should buy random junk, but I’d take this paper with a large grain of salt.
- rantingdemon 3y agoYes exactly. No security conscious person I know would just plug in some unknown USB device. It's a very, very well known attack vector. If the point of the exercise is a proof of concept as an expirement then awesome. If it's supposed to be something you can hand out to stakeholders as a business card then it's probably not that useful.
- ArtemZ 3y agoIt looks expensive (per card), unprofessional (especially the use of an SD card) and impractical.
- paulddraper 3y agoNo one will disagree.
- dmitrygr 3y agoUnder $20 ea. And SD card is easier to image than eMMC. But if it is not professional enough for you, I’ll be sure to not give you one :)
- AstroJetson 3y agoI'm super impressed and think it's very professional. I actually used the DECStation so I'm going wow, that beast of electronics is on a business card. I loved the story of decide what chips to use, build a card, now write an emulator of a long gone processor, now get Linux to work and hey, make Ultrix work too. Great story, I liked the documentation of the step by step how to do it. It was nice that you had the details of the process including the good, the bad and the ugly. Lots of these stories are "bought CPU, Memory, a few caps; built a board, did some software; here is final product". I got a feel for the hours you spent and the dedication to seeing it through. As a former employer (retired) it would have caught my attention. Congrats on a great project, hope it's been helpful to get you cool jobs. If you ever make it to the Philly area, let me know, I'd love to see it run.
- urbandw311er 3y agoThis looks hugely cool but I found it a bit inaccessible to fully understand the project goal and accomplishment. It would nice to get a bit more of an overview of the finished article - photo of completed card, or a video or screenshots of what happens when you plug it in etc. Or perhaps somehow I missed all this!
- dmitrygr 3y agoEmulate a system well enough to be usable in realtime on a low budget small form factor board of my design. Result: success.
- okwhateverdude 3y agoDude wrote a CPU emulator with all the fixin's to emulate a particular ancient computer. That emulator is compiled then flashed on a microcontroller and then uses that emulator to run linux and ultrix which target this particular emulated environment. Also seemingly includes exposing a serial console via USB to allow interacting with the system. It is all a bit inception-y, but no doubt a master work. The images of the PCB have silk screen explaining what happens when you plug it in.
- deleted 3y ago[deleted]
- metadat 3y agoI'm with you, @urband311er, really would enjoy seeing a video of it booting and running... It'd be infinitely more satisfying to [nearly] experience what the finished product is like.
- syndicatedjelly 3y agoI think i missed something. Why did you use the word “accessibility” there?
- mmaunder 3y agoKinda similar to DEF CON badges. Very cool!!
- jmwilson 3y ago(2022) The first time I saw a PCB business card, I thought it was pretty cool. Then I saw a PCBA business card (with components!) and was amazed. But now I just see them as unnecessary e-waste for vanity. Business cards get read, scanned, and tossed. At least the impact of a piece of paper and ink is small compared to fiberglass resin, copper foil, ENIG, and solder mask. This example isn't even that great as a business card: the typography and contrast make the contact information poorly legible compared to the component silkscreen. Amazing PCB art (https://grandideastudio.com/portfolio/projects/the-worlds-thinnest-boombox/ https://grandideastudio.com/portfolio/projects/the-worlds-th... is the best I've seen) makes creative use of the different contrast, translucency, and textures between exposed and masked copper, masked and unmasked bare FR4, and silkscreen layers. It's a very constrained graphic design problem that takes a good eye.
- fnordpiglet 3y agoThe PCB business card is about 0.5% of what’s interesting about this. The artistry is what the business card is running, and that’s also the remaining 99.5% of the links content.
- therealcamino 3y agoGuy: "I wrote a MIPS R3000 emulator from scratch, ran it on a microcontroller on a board I designed myself, and emulated a late-80s DEC workstation well enough to run not just Linux, but also DEC's own proprietary closed-source Unix on it (although I had to patch the Ultrix kernel's machine code, without source code or even symbols in the exec, to fix a bug). For fun." Internet: "Pssh. Not pretty enough. Next!"
- nullwarp 3y agoThis site has some of the worst attitudes towards anything that's not just the same old apple garbage. Bring something thats genuinely unique or something that really encompasses the spirit of what a hacker was when I was growing up you just get garbage responses like the parent.
- StevePerkins 3y ago
- neilv 3y ago> I searched around for a cool system and settled on DECstation2100 (or its big brother - DECstation3100). The DECstation 3100 was nice. It was very fast at the time it came out, and had the huge CRT with the GUI desktop, mouse, etc., a few years after the Mac. It also my first time seeing a Unix workstation, which was fantastic at the time, since I'd only ever touched Unix on BBSes and on random old underpowered timesharing boxes with old dumb terminals. (It was an internship, I was in charge of the porting lab for some very expensive software, and our first DECstation 3100, hostname `screamer`, was probably our fastest at that moment, so it doubled as my first workstation.) Ultrix was a decent Unix, and DECwindows was nicer than the stock X11 found on many other Unix workstations. Not as consumer-products polished and friendly as the Mac, but obviously a more powerful OS, and more flexible distributed window system. Another nice thing about Ultrix was that it could talk both TCP/IP and DECnet. I used this to rig up transparent access to our VAXstation 3100 VAX/VMS units remotely from people's Sun workstations in their cubes. (And without trying to get purchase authorization for something like Multinet for the VAXstations.) (This gateway later evolved into a small part of the Common User Environment (CUE) that I developed as an over-enthusiastic intern's evenings&weekends project, which gave familiar and powerful UI, features, and accesses, no matter which workstation or porting system you were in front of. Which was before the Unix workstation vendors got together to make CDE, but got their lunch eaten by Windows NT on the engineering desktop, and eventually by Linux on the dotcom servers. And you tied an onion on your belt, which was the fashion of the day.) This article of course demonstrates much more intimate familiarity with the DECstation 3100 than I ever needed to have, and is very impressive.
- lizknope 3y agoI had used AIX and SunOS in high school but when I started college in 1993 our university had hundreds of DECstation 2100 and 3100 machines. There were a few DECstation 5000 machines that were faster. I thought they were great machines but over the next few years almost all of them were replaced with Sun SPARC or HP PA-RISC machines that had more software available for them.
- cmrdporcupine 3y agoI love that era of Unix workstation computing. As a teen I'd buy copies of UnixWorld at the bookstore mainly just to gawk at the screenshots and photos of the workstations. Looking back, isn't it kind of crazy that a) such a magazine existed b) it was on the magazine rack at random bookstores in the middle of nowhere? And when I finally got a 486/50 that could run Linux, I spent hours tweaking my desktop env to try to make it more workstation-y (OpenLook or Motif-ish), purely on aesthetic grounds not for practical purposes :-)
- neilv 3y agoI sure hope that this Dmitry person, with the impressive engineering effort "business card", never walks into an interview to encounter... "Let's start by you going to the whiteboard, and doing this Leetcode problem. We want to see how you think." :)
- tomcam 3y agoThe only reality tv show I would watch
- dmitrygr 3y agoOther than Facebook, no. Nobody else has tried that with me. (Am that dmitry)
- stevekemp 3y agoThat's how you find writeups like this: https://aphyr.com/posts/353-rewriting-the-technical-interview https://aphyr.com/posts/353-rewriting-the-technical-intervie...
- dang 3y agoRelated: My business card runs Linux - https://news.ycombinator.com/item?id=32077823 https://news.ycombinator.com/item?id=32077823 - July 2022 (133 comments) My business card runs Linux, yours can too - https://news.ycombinator.com/item?id=32071593 https://news.ycombinator.com/item?id=32071593 - July 2022 (3 comments) Similar but different: A DIY business card that runs Linux (2019) - https://news.ycombinator.com/item?id=36176198 https://news.ycombinator.com/item?id=36176198 - June 2023 (58 comments) My Business Card Runs Linux - https://news.ycombinator.com/item?id=21871026 https://news.ycombinator.com/item?id=21871026 - Dec 2019 (397 comments)
- kureikain 3y agoanyone know a good guide to getting started with these kind of projects? such as say I have an idea any general guide to: - development env with simulator - development board - production hardware
- dmitrygr 3y agoGameboy is a nice system to start working on emulation with. Very well documented. Many games use only a small fraction of capabilities making progress visible.
- deleted 3y ago[deleted]
- lmm 3y agoIt feels really backwards if the right way to run Linux on this microcontroller is by emulating something else. Was emulating an old system really the best/easiest way to do this, or is that part just for fun?
- dmitrygr 3y agoIf you would like to port Ultrix to cortex-M I’d love to run it natively.
- lmm 3y agoUltrix would always involve an emulator one way or another, sure, but it sounds like Linux was the main point, and that runs natively on cortex-M, right?
- dmitrygr 3y agoNo-mmu kernel sort of can, if you call that linux (no fork)… and If you have enough ram. This board doesn’t since ram isn’t memory mapped. This board would never run Linux natively.
- fsckboy 3y agoperfectly cool project and accomplishment, but title should be "my business card snags, snares, and ruins fabrics... but it's really cool in a 'it's been done before' sort of way"
- johngossman 3y agoThis is very cool. Brings backs memories and makes me feel very old. I can't believe what was once the fastest computer I'd ever used can now be emulated on a business card. So, story. I worked in a small shop that wrote CAD software. DEC leant us one of the machines to port to Ultrix. We got the port done and the box sat around, occasionally used for debugging and new builds. One day, my buddy and I were playing nerf football in the office. I missed a catch, and the ball hit a can of coca-cola sitting next to the nice $20k loaner DECstation, which poured directly into the case (from the side). I reached down instinctively and yanked the power cord out of the wall (knowing that was probably not going to help much). When we opened the box, we found the most beautiful little circuit board, mounted an inch off the floor of the case. The bottom of the case was a perfectly flat piece of metal, with nothing touching it (the board was mounted to the sides). There was a pool of soda under the board, and nothing important, nothing electronic was touched. I sponged out the case, gingerly plugged it back in and it booted up. This was the only thing we ever did in the office that we never told the boss about.
- cmrdporcupine 3y agoThe breakdown on how the MMU works is one of the clearest and most readable descriptions I've seen. Usually my eyes glaze over and I get lost in the details, but this is quite well written.
- amiljkovic 3y agoCould have made a hole in the pcb the size of the chips, and flip them so they take up less vertical space which makes the card more flat. Not sure about the uSD card slot but a solution for that might also be possible.
- dmitrygr 3y agoyes, but then JLCPCB would not have assembled it for me. I would not want to assemble a few dozen of those by hand...
- jsz0 3y agoI usually dismiss this type of stuff as being cool but ultimately a massive waste of time. In this case however how can you argue with the results? He can hand this card to any potential employer and probably get any job he wants. Having a passion for something and finding a constructive outlet for it is quite an achievement.