A week of security testing on a Prusa MK4S running Buddy firmware 6.5.7 uncovered 14 findings comprising roughly 23 defects, including a chain to remote code execution on the printer’s main controller. The critical flaw begins in Prusa Connect: a SEND_FILE_INFO command can supply a path longer than the 104-byte limit assumed by the code. That limit existed only as an assertion removed from release builds, allowing a long path to overflow a shared buffer and corrupt adjacent data. Combined with further weaknesses, an attacker controlling or intercepting Connect traffic - or compromising its backend - could run code on the printer. The researcher also found issues in G-code parsing, USB and FAT handling, transfer recovery, the MMU, and EEPROM. Three of the four findings in the first report package were confirmed on physical hardware; the remaining findings were validated through fuzzing, source review, or AddressSanitizer.
The investigation combined millions of mutated G-code inputs and HTTP requests, reverse engineering, a Cortex-M emulator running the signed firmware image, and AI-assisted analysis. The researcher separated hardware-confirmed findings from less directly verified ones to make confidence levels clear, and gave Prusa the test tools and proof-of-concept material. Prusa acknowledged the report within a working day, reproduced the issues, coordinated an embargo rather than demanding silence, and asked how the researcher wanted credit. The main process criticism was that Prusa’s security contact file initially returned a 404. All reported findings were fixed in Buddy firmware versions later than 7.0.0; affected printer owners are urged to update.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A covert Russian network used fake media posts to exploit French riots, spreading false claims about migrants and portraying the government as weak. French and EU assessments also found Israeli-linked and MAGA accounts pushing hostile narratives about the unrest. (reuters.com)
A Microsoft-signed boot shim can be reused to undermine Secure Boot protections on corporate computers. The research explains how Secure Boot validates trusted boot components and previews a practical technique for exploiting that trust. (leosmith.wtf)
ChatGPT Desktop forwards your local SSH agent to remote machines. Remote agents can use your SSH credentials to access private repositories and push code. (news.ycombinator.com)
Chinese surveillance technology is helping repressive African governments monitor citizens and suppress dissent. The systems give authorities tools to track critics and control public activity. (economist.com)
U.S. officials say Alice Huang, a Chinese businesswoman close to Nvidia CEO Jensen Huang, was recruited by China’s Ministry of State Security to gather intelligence on him and seek access to advanced AI chips. House committee leaders have requested a closed-door briefing from Jensen Huang about his interactions with her. (nytimes.com)
Security researchers found vulnerabilities in a major automaker’s connected-car systems while examining the infrastructure behind its remote-unlock app. An exposed admin tool and weaknesses in the platform enabled access to cars across much of the world. (shubs.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.