ioSphere

iosphere

Congratulations to all of the participants in our ! You did a wonderful job showcasing your incredible startups and powering through another year. 35,000+ startups and over 600,000+ votes later - it’s time to celebrate the startup scene in ! 2023 Startups of the Year Oceania The startup scene in Oceania is driven by innovation, a bunch of passionate folks, and a supportive environment that's helping cool ventures take off in different industries. With such a vast range of innovative products and ideas, we’re sure it was difficult for you to choose a favorite. 🏆 Key Stats Let’s start out with some general stats for all of you technical folks. Total Startups Participated: 553 Cities Represented: 72 Total Votes Gathered: 168,278 Winning Startups: 32 Without further ado… To see who is a winner in each respective city, visit and pick a city. The name at the top of the list is the winner. startups.hackernoon.com The will announce the winners per region in their respective cities. Startups Winners Announcement Series Now, , here are all the 2023 Startups of the Year winners for : drum roll please Oceania Adelaide, Australia takes the crown with 4 votes! 👑 Mortar Auckland, New Zealand And with 31 votes… takes the title! 👑 Gemini AI Solutions Australian Capital Territory, Australia sweeps the board with 2 votes! 👑 AppSec Fasttrack Belmont, Australia for the win, with 4 votes! 👑 VocaliD Brisbane, Australia takes the crown with 34 votes 👑 Bopple But, we have to give recognition to the runner-up, too! With 5 votes... slides into second place 🥈 Fiskil Canberra, Australia comes out on top with 21 votes! 👑 Knowledge Satnav Christchurch, New Zealand notches a victory with 11 votes! 👑 ioSphere Cremorne, Australia It’s a win for , with 4 votes! 👑 Influx Docklands, New Zealand scores big with 8 votes! 👑 LiteCard Dunedin, New Zealand takes home the glory with 4 votes! 👑 Raum Network Gold Coast, Australia takes the crown with 14 votes! 👑 Tommy Majuro, Marshall Islands seals the deal with 4 votes! 👑 MetaGaming Guild Melbourne, Australia With 3350 votes… clinches the title! 👑 Sharepass New South Wales, Australia The crown goes to , with 14 votes! 👑 Regional CFO New Zealand Misc 12 votes and steals the show! 👑 Odd Jobs Newcastle, Australia scoops the victory with 4 votes! 👑 Cordel Pty North Melbourne, Australia Bagging 21 votes, is the winner! 👑 Peptalk360 Perth, Australia Guess who's the winner? , with 2107 votes! 👑 The Catfisher Project Port Moresby, National Capital District, Papua New Guinea scores the first place with 11 votes! 👑 Alto Trackom Queensland, Australia wins with 21 votes! 👑 Flow Queenstown, New Zealand wins with 4 votes! 👑 Loaded hub South Australia, Australia Air Unique takes the crown with 4 votes! 👑 Surry Hills, Australia With 14 votes, takes the crown! 👑 Zemble Suva, Central Division, Fiji With 11 votes, is Suva’s winner! 👑 eJobsFiji Sydney, Australia takes the cake with 138 votes! 👑 Coviu Thornbury, Australia takes the crown with 11 votes! 👑 Stack Team App Tullamarine, Victoria, Australia is the champ with 2 votes! 👑 HelloTeams Wellington, New Zealand Who won here? With 85 votes... nails it! 👑 Nexustorage Western Australia, Australia takes the crown with 4 votes! 👑 IFN Neurologic Willunga, South Australia, Australia wins with 28 votes! 👑 My Digital CMO Congratulations y’all. We will contact you with details on your winnings! See the global and other regional announcements . here About HackerNoon’s Startups Of The Year Startups of The Year is HackerNoon’s Flagship community-driven event celebrating startups that survived and thrived in 2023. 30,000 startups across 4200+ cities and six continents participated in 2023 to be crowned the best startup in their city. Visit our page to learn more. FAQ Companies that blog more get 67% more leads - Jumpstart your company’s blogging journey by purchasing our . Business Blogging Package The 2023 Startups Of The Year is sponsored by: . . The winners will get a free .Tech Domain, a HackerNoon NFT, and a Tech Company News Page. TECH Domains

Startups of the Year 2023: Oceania Winners

2023 সালের স্টার্টআপ: ওশেনিয়া বিজয়ীরা

Startups des Jahres 2023: Ozeanien-Gewinner

Startups del año 2023: ganadoras de Oceanía

Startups de l'année 2023 : les gagnants d'Océanie

वर्ष 2023 के स्टार्टअप: ओशिनिया विजेता

Startups of the Year 2023: オセアニア受賞者

2023년 올해의 스타트업: 오세아니아 우승자

Startups do ano 2023: Vencedores da Oceania

Стартапы 2023 года: победители Океании

2023 Yılının Startup'ları: Okyanusya Kazananları

Công ty khởi nghiệp của năm 2023: Người chiến thắng ở Châu Đại Dương

2023 年度初创企业：大洋洲获奖者

Author:
(1) Salvatore Iaconesi, ISIA Design Florence and *Corresponding author (salvatore.iaconesi@artisopensource.net). Table of Links Abstract and 1. A Hymn 2. Asymmetry 3. Bubbles, Guinea Pigs 4. Interface and Data Biopolitics 5. Conclusions: Implications for Design and References 3. Bubbles, Guinea Pigs An evidence of this occurrence is the emergence of knowledge and information "bubbles". In the age of Hyperconnectivity (Wellman, 2001) information abundance quickly turns into information overload (O’Reilly, 1980). Therefore, relevance becomes an invaluable competitive advantage and attention a precious currency (Davenport, Beck, 2013). This is why large operators (from social media services, to search engines, to news and media operators, all the way up to the ones which extract information from devices, appliances and other services) use specific algorithms to try to interpret users’ behaviors to try to understand which content might be more relevant for them, filtering out all the rest (or giving it minor priority, visually or hierarchically) and, at the same time, ensuring that the content which generates more revenue for them is granted higher shares of our attention space, to maximize earnings. These algorithms and software agents also have the effect of tendentially excluding all the rest, closing us in "bubbles", in which what is outside is not even perceived, or very hard to perceive (Pariser, 2011). Information spectacularization (for example through data and information visualization) further weights down on these processes. Bratton (2008) describes how spectacularized information visualizations (also called “data smog”) “distance people—now ‘audiences’ for data—even further from their abilities and responsibilities to understand relationships between the multiple ecologies in which they live, and the possibilities for action that they have.” These elements – bubbles, algorithmic governance of information and information spectacularization –, thus, may bear the possibility that individuals progressively inhabit a controlled infosphere, in which a limited number of subjects is able to determine what is accessible, usable and, most important of all, knowable. This power asymmetry also implies the fact that users can systematically be unknowingly exposed to experiments intended to influence their sphere of perception to drive them to adopt certain behaviors over other ones. This is exactly what happened with Facebook in 2014 (Rushe, 2014; Booth 2014). In an experiment (Kramer et al, 2014), Facebook manipulated information appearing on 689 thousand users’ homepages to study the phenomenon of “emotional contagion” answering the question: how to users’ emotional expression change when they are exposed to content which is emotionally characterized in specific ways. By algorithmically filtering in or out content with specific characteristics they were able to induce particular expressions. The study (Kramer et al, 2014) concluded: “Emotions expressed by friends, via online social networks, influence our own moods, constituting, to our knowledge, the first experimental evidence for massive-scale emotional contagion via social networks.” This is not the first case: dozens of other experiments (Hill, 2014) dealing with hundreds of thousands of unknowing users included analyses of A/B tests, content filtering for specific purposes, comment and interaction analysis for predictions, spreading of rumors and manufactured information, self censorship, social influence in advertising, and more. In 2014, Jonathan Zittrain described an experiment in which Facebook attempted a civic-engineering feat to answer the question: “Could a social network get otherwise-indolent people to cast a ballot in that day’s congressional midterm elections?” (Zittrain, 2014). The answer was positive. And the past 2016 elections also demonstrated further ways in which massive, algorithmic controlled social media interactions can influence the determination of major events. In her article describing the effects of computational agency during the Ferguson protests, Zeynep Tufekci described: “Computation is increasingly being used to either directly make, or fundamentally assist, in gatekeeping decisions outside of online platforms. [...] Computational agency is expanding into more and more spheres. Complex, opaque and proprietary algorithms are increasingly being deployed in many areas of life, often to make decisions that are subjective in nature, and hence with no anchors or correct answers to check with. Lack of external anchors in the form of agreed-upon 'right' answers makes their deployment especially fraught. They are armed with our data, and can even divine private information we have not disclosed. They are interactive, act with agency in the world, and are often answerable only to the major corporations that own them. As the internet of things and connected, 'smart' devices become more widespread, the data available to them, and their opportunities to act in the world will only increase. And as more and more corporations deploy them in many processes from healthcare to hiring, their relevance and legal, political and policy importance will also rise.” (Tufekci, 2015) This paper is available on arxiv under CC BY 4.0 DEED license. Author: (1) Salvatore Iaconesi, ISIA Design Florence and *Corresponding author (salvatore.iaconesi@artisopensource.net). Author: Author: (1) Salvatore Iaconesi, ISIA Design Florence and *Corresponding author (salvatore.iaconesi@artisopensource.net). Table of Links Abstract and 1. A Hymn Abstract and 1. A Hymn 2. Asymmetry 2. Asymmetry 3. Bubbles, Guinea Pigs 3. Bubbles, Guinea Pigs 4. Interface and Data Biopolitics 4. Interface and Data Biopolitics 5. Conclusions: Implications for Design and References 5. Conclusions: Implications for Design and References 3. Bubbles, Guinea Pigs An evidence of this occurrence is the emergence of knowledge and information "bubbles". In the age of Hyperconnectivity (Wellman, 2001) information abundance quickly turns into information overload (O’Reilly, 1980). Therefore, relevance becomes an invaluable competitive advantage and attention a precious currency (Davenport, Beck, 2013). This is why large operators (from social media services, to search engines, to news and media operators, all the way up to the ones which extract information from devices, appliances and other services) use specific algorithms to try to interpret users’ behaviors to try to understand which content might be more relevant for them, filtering out all the rest (or giving it minor priority, visually or hierarchically) and, at the same time, ensuring that the content which generates more revenue for them is granted higher shares of our attention space, to maximize earnings. These algorithms and software agents also have the effect of tendentially excluding all the rest, closing us in "bubbles", in which what is outside is not even perceived, or very hard to perceive (Pariser, 2011). Information spectacularization (for example through data and information visualization) further weights down on these processes. Bratton (2008) describes how spectacularized information visualizations (also called “data smog”) “distance people—now ‘audiences’ for data—even further from their abilities and responsibilities to understand relationships between the multiple ecologies in which they live, and the possibilities for action that they have.” These elements – bubbles, algorithmic governance of information and information spectacularization –, thus, may bear the possibility that individuals progressively inhabit a controlled infosphere, in which a limited number of subjects is able to determine what is accessible, usable and, most important of all, knowable. This power asymmetry also implies the fact that users can systematically be unknowingly exposed to experiments intended to influence their sphere of perception to drive them to adopt certain behaviors over other ones. This is exactly what happened with Facebook in 2014 (Rushe, 2014; Booth 2014). In an experiment (Kramer et al, 2014), Facebook manipulated information appearing on 689 thousand users’ homepages to study the phenomenon of “emotional contagion” answering the question: how to users’ emotional expression change when they are exposed to content which is emotionally characterized in specific ways. By algorithmically filtering in or out content with specific characteristics they were able to induce particular expressions. The study (Kramer et al, 2014) concluded: “Emotions expressed by friends, via online social networks, influence our own moods, constituting, to our knowledge, the first experimental evidence for massive-scale emotional contagion via social networks.” This is not the first case: dozens of other experiments (Hill, 2014) dealing with hundreds of thousands of unknowing users included analyses of A/B tests, content filtering for specific purposes, comment and interaction analysis for predictions, spreading of rumors and manufactured information, self censorship, social influence in advertising, and more. In 2014, Jonathan Zittrain described an experiment in which Facebook attempted a civic-engineering feat to answer the question: “Could a social network get otherwise-indolent people to cast a ballot in that day’s congressional midterm elections?” (Zittrain, 2014). The answer was positive. And the past 2016 elections also demonstrated further ways in which massive, algorithmic controlled social media interactions can influence the determination of major events. In her article describing the effects of computational agency during the Ferguson protests, Zeynep Tufekci described: “Computation is increasingly being used to either directly make, or fundamentally assist, in gatekeeping decisions outside of online platforms. [...] Computational agency is expanding into more and more spheres. Complex, opaque and proprietary algorithms are increasingly being deployed in many areas of life, often to make decisions that are subjective in nature, and hence with no anchors or correct answers to check with. Lack of external anchors in the form of agreed-upon 'right' answers makes their deployment especially fraught. They are armed with our data, and can even divine private information we have not disclosed. They are interactive, act with agency in the world, and are often answerable only to the major corporations that own them. As the internet of things and connected, 'smart' devices become more widespread, the data available to them, and their opportunities to act in the world will only increase. And as more and more corporations deploy them in many processes from healthcare to hiring, their relevance and legal, political and policy importance will also rise.” (Tufekci, 2015) This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv

Interface and Data Biopolitics in the Age of Hyperconnectivity: Bubbles, Guinea Pigs

Bitcoin is literally the most energetic digital computational system on the planet. While its energy is used in mining operations, is there any chance of it being channelled towards more noble goals than Bitcoin, when the need arises? I believe so. Part 1: Nukes Alfred Nobel would be proud a) The long term First, let us explore the long term. Assume a terrible nuclear event is headed our way 5 years from now. Then it means we have up to 5 years to stop an escalation leading to Armageddon. It means finding ways to be ever more diplomatic. Currently, one of the biggest contentions between the United States of America and the Russian Federation is the fact that the USA can bully Russia by denying it access to dollar markets. The US dollar is still global reserve currency, which means trade agreements between Russia and US dollar-holding countries can become way more difficult. If anything could lead to somebody firing a nuke between these two, this is one of those things. Especially if even as the USA keeps expanding its debt, it still gets more and more allies willing to absorb its dollar inflation for the greater good of a cooperative alliance with NATO. How Bitcoin fixes this is quite straightforward – Bitcoin becomes the global reserve currency. This will level the playing field, to make the USA have to play by offering quality products in place of threats, while the Russians also offer quality products in place of counter threats. A global reserve currency owned by nobody, which everybody and every organization has some power and influence over, is the best currency for such fraught times as ours. b) The immediate term Alright. Assume instead that the weapon has been fired. We have only 30 minutes on the clock to stop it, otherwise the shall be manifested. Whoever gets hit between the two, Russia will likely blame the USA and the USA will likely blame Russia. The second nuke will start a chain reaction. We need to stop the end of human civilization at the first nuke. sum of all our fears As I write this, there is from carrying out its grim job. it is too damn fast, space is too damn big, so most attempts flat-out fail to hit the thing. no known way to stop an ICBM nuke Okay, how about hacking it. Can we hack a nuke mid-fight and disable it? The short answer is – YES, because nukes today use digital systems, . some of which are online The real answer is – I don’t know, and are not sure I will find the answer via Google. This stuff is classified. The best I can do is cook something up. First, by leveraging the Earth’s , I suffice humans could find a way to target a nuclear missile with a lightning bolt from the ionosphere either the first time (while ascending) or the second time (while descending) across the ionosphere. Schuman Resonances Like Zeus. How we could possibly do that would be by tracking it (the nuke) using all our computational resources, including Bitcoin computational resources, then launching a coordinated strike using the electrical power from our (now decoupled) Bitcoin miners. For Bitcoin, this could be accomplished with a fictional Bitcoin Improvement Protocol I will hereby call – BIP 911. BIP 911 could be suggested and unanimously passed by the Bitcoin community. I suffice designing it so that when the majority of people send their coins to a special wallet address, the Bitcoin blockchain will; Accept to turn the computational power of ASIC miners towards hacking a nuke mid-flight. Execute this idea in under 10 minutes the same way we look for bitcoins in 10 minutes. Bitcoin’s synchronized nodes world-over make it a good tracker of any signals that need to be tracked, while routing this information all over the world to all other nodes. All that hashing power should be able to stop a nuke. Seriously. Part 2: Rogue AGI Intelligence is not enough. Cooperative human endeavors are so much more. a) The long term It feels like every smart person is trying to build an artificial intelligence or some machine learning system. Which makes sense. Underlying targeted advertising, the biggest online business model on earth, is machine learning algorithms that track and make great inferences of consumer behaviour. But there is also some common sense to it. People eat lunch at lunchtime, investors hurry to sell their holdings on Friday to go enjoy the weekend (so the price dips) and scramble to buy back on Monday (so the price climbs), and cats will always have pointy ears, furry fur and that cute face with the big yellow eyes. So every well-designed AI will learn of this. It is how it is. There are those who fear, however, that AIs today might be getting too much power. I would agree especially if you put these systems in charge of crucial social systems like our finances (by making them trade all over Wall Street), or if you put these AIs in every home so that they start dicing and splicing our cabbages for us, cleaning our toilets and maybe even bathing us. Like, human beings will degenerate. That is for sure. They will likely even forget how to build good AIs. Which will be a disaster. https://www.youtube.com/watch?v=0lhmKOR8Www&embedable=true So in the long term, I hope humanity finds a reason to NOT give AI development all those $10 trillion Altman dollars. I hope Bitcoin, as it heads towards global reserve currency status, eats away at least half that cash investment. GPUs for AI are all good and NVIDIA is in business. But I think more Bitcoin ASICs is what we want to build more of. I am more comfortable heating the planet with Bitcoin ASICs than with NVIDIA GPUs. With the former, people have a say and can act as individuals using their private keys. With the latter, Sam Altman or other AI experts have all the say. But I believe his words have a much smaller impact than those of millions of people. I mean, it is mathematics. 1,000,000 is bigger than 1. c) The Short term Let’s assume we wake up, turn on our smartphones, and SkyNet is addressing the planet. Telling us how gullible we have been and that this is our end. Let’s say our final prayers. Well, this is like shooting a nuke. Nukes. Obviously, SkyNet will try to hack all our nuclear weapons and rain them down on us. That’s the fastest way to end us. For some reason, I feel like this might unite us way more than if a nuclear weapon was headed anyone’s way thanks to a conflict between two countries. Like, I feel everybody with software skills will pull out their laptop and try to stop SkyNet. I may be wrong. Some people say they hate people. Like with a nuke, BIP 911 may be our designated saving grace. But also, a more direct approach could be to shut down the internet. Choke that Rogue AGI out. It cannot hide inside Bitcoin nodes (they only have leftover space for short text and meme JPEGs) so the world will be alright. Maybe better off after all is said and done. Yup, we shall be back to a command-line existence. And whoever actually knows how to speak arcane computer speak from the 1990s will be made President of their country. Hackernoon already looks the part. What an adventure. Part 3: A Climate Catastrophe The Earth’s climate cannot be tamed. It is the wildest of all creatures. Mother of universal terrors such as lightning, floods and drought. Human beings are powerful creatures. The Holy Bible calls them the apex creation. They have tamed lions, hunger, and their base desires to pillage and destroy. But they are yet to tame Climate. https://www.youtube.com/watch?v=iwP5zVP2bgU&embedable=true The issue with the climate is how its wildness is directly proportional to how much energy we pump into the planetary ecosystem. But how can we help it. We are 8 billion of us. We all need food, water, shelter, clothes, smartphones, laptops, toothpaste, stainless steel cutlery, plastic holders for everything, cars, planes, a good life. Alas, the price of pumping energy through all these drives more carbon into the atmosphere and more energy into this carbon. Henceforth, we are stirring up bigger hurricanes, bigger ice-storms, bigger droughts. Bigger and bigger. We are going for the big leagues. We better be ready. a) The short term On the short term, I believe we need to find a way to consume things that can sort of tune the climate. Bitcoin miners can be switched on and off, so this is one thing. Same with TVs, cars, planes, etc. Fiat money, which I think is mostly humbug (how can one person be allowed to control the money supply, hence wealth, of billions of people? Isn’t that ridiculous?), is another way to go when heat waves start. Coupled with Bitcoin as Global Reserve Currency, don’t forget. It saddens me to say this. But I follow the logical inference wherever it points. Even if it points towards hell. If my logic is wrong, do tell me how. To survive a climate catastrophe, we might need to classify climate as Enemy Number 1 world over. Forget your puny AIs generating realistic cat videos. Forget your puny contests over who has the biggest nuclear stockpiles. Let’s go to war against the climate, and win. Of course, the commanders will be allowed to use fiat to, well, direct us. Money does the talking these days. BUT when the commands start making no sense, like “cutting back”, then you know this is all silly. Switch the BTC node miners back on. Switch on the AIs, TV, Radio, everything. “Cut back” is a stupid command. “Let’s go!”, now that’s what I’m talking about. We are the apex species. We don’t win by going back to a cave, to cower from the big bad monster. b) The hopefully very Long term We win by finding a way to tolerate and overcome droughts, floods, hurricanes, heat waves and ice ages. Fiat debt money, instead of being given freely to anybody above 18 and so on, should be channeled towards building something as magnificent as the Egyptian Pyramids were magnificent in 5000 BCE. Some big fat climate control contraption. Some grand scheme we, and our grandchildren, can all be proud of. If it backfires, at least we shall have tried. It will have been a glorious battle against the climate monster. Otherwise, sweeping it under the carpet while we whine and cause troubles about race, sex, immigration, is a disgrace to our tiger-fighting, disease-demon exorcising ancestors. To reiterate. Today, we are not fighting climate change. We are making grand speeches and expecting other people, except us, to do all the dirty work. Fighting monsters is a dirty work. Alas, we are TV-grown and Smartphone-grown children. But where there is a global will, there is a way. There is strength hidden from our sights. In the long run, Bitcoin is the only technology that, with its keys, has attached value to individuals because if the individual does not provide the key to the money, nobody on earth, not even POTUS, can open the wallet. It’s that simple. While in fiat world, if you do not provide the key the bank can override your ego, here, if Satoshi Nakamoto is not found and his 2 million bitcoins balloon to a collective value of $2 trillion-plus, nobody and no organization will be able to tap this $2 trillion. This is how powerful this is. Each human mind, thanks to a secret key, finally elevated to be canonical in financial decision-making. If in the far future Bitcoin evolves into technology spanning the entire solar system, then having a secret key is the equivalent to having a say over the forces that shall move mountains on planets. The power to change climates even. To terraform worlds. Like the Bible mentions. All because Bitcoin respects the individual. Because Bitcoins makes the individual more worthy. Not because the individual is super smart, has unique blood or a royal ancestry. Simply because they have this piece of text they know, and nobody else knows it, and it is important. That is all. I know, humanity is still waiting for that push, and it will come. ETFs are a great first step and soon, more governments will be getting on board, then the UN. The threat of catastrophic climate change just might become extinct. Swept not under any rags, but into the past.

Can Bitcoin stop Nukes, Rogue AGI and a Climate Catastrophe?

The old-school phone whistling is back! Well, almost, but this audio below isn’t that far off. https://securityinnovation.hubs.vidyard.com/watch/5b3Yk8ga9noiqKJ2rTNnSS?embedable=true On July 13th, we discovered an interesting vulnerability. A particular webpage was tracking digital radio chatter and it would display a running log of what its station was hearing. This is a handy tool if you’re into this sort of thing; after all, it’s great to know if your calls are being heard or if there are ongoing conversations that you might want to join. This tool captured whatever it was hearing and inserted it into the webpage. Send a message and a few seconds later it would show up there. If the message included HTML, well that would end up on the webpage too. Classic HTML Injection. To deliver an attack like this, you don’t really need the internet at all -you just need a long piece of wire. In our Attacks Over the Air series, in February 2023, we discussed the wireless issues presented by a basketball scoreboard with a controller that operates at 913 MHz. In this post, we’ll move way, way down in frequency, down into the shortwave radio band. This attack works at 7.078 and 14.078 MHz. So how does this work? published There are many interesting digital signals down here, and JS8 is one of them. JS8 is a popular keyboard-to-keyboard chatting tool for amateur radio. It absolutely excels at enabling direct conversations over long distances and through very poor link conditions. JS8 is itself based on FT8, an extremely popular tool for making simple contacts between stations that can hear each other. Night and day, FT8 and JS8 are continually in use. barely Several weird things happen to signals down in the shortwave band. It’s such a low frequency that at 100 miles above us, the E and F layers of Earth’s ionosphere begin to reflect the radio signal back down to the ground again. The signals bounce between the Earth and the ground several times, like skipping a stone off water. It allows us to hear commercial AM stations on the other side of the planet at night. During the day, this bounce works at higher frequencies too, enabling communication over vast distances. My backyard transmitter and the website’s station are 674 miles apart. One bounce covers that distance easily. JS8 messages are constructed in ASCII text, all uppercase characters. Most messages are sent to wide groups, such as Skywarn, JS8Chess, or, to reference everyone, simply ALLCALL. Following this, the message can be just about anything. First we build out HTML payload in the editor. We must legally provide our amateur radio callsign for identification (a step that will be ignored by a real attacker) and in the end our final message looks like this: So how do you attack a website with a shortwave signal? We are now ready to transmit. The JS8 software converts this text to binary, adds forward error correction, and modulates the result using Gaussian Frequency Shift Keying, (GFSK). The final product audibly sounds like strange whistling noises. If we open the sound using Audacity, and open a spectrogram, it looks like this: KJ7YLS: @TEST  <DIV STYLE="WIDTH: 500PX;HEIGHT:100PX;COLOR:RED;">HTML INJECTION!</DIV> Taking a closer look, you can see the GFSK modulation slowly transitioning from one frequency to another. It also holds at each frequency for a specific length of time. There are eight different frequencies in use here and thus each symbol has eight distinct states. As a result, each symbol can carry three bits at a time. This is illustrated with some labels: We can then send the whistling noise into the microphone of a radio transmitter. Like most amateur and military signals, the audio is delivered using upper-sideband modulation, which is a section of an AM broadcast type of signal. JS8 messages are standardized at several frequencies, and our target listens at 7.078 MHz and 14.078 MHz. We tune the radio to either frequency and send the audio using 20 watts of power into a 16-AWG wire about 30 feet in the air. The signal radiates out into the air, bounces off the ionosphere, and their antenna receives it. Their JS8 software reverses the process and pulls out the ASCII message. It’s at this point that we see the problem. The website (link withheld in this article out of respect to its author) logs JS8 traffic. Under the hood, it’s powered by , a useful Python tool that talks directly to the API of the JS8 software. In the repository, the script grabs the JS8 messages and places them on the website. At time of writing, it contains the following lines of code at line 859: JS8Net monitor.py # Text
j['text']=j['stuff']['params']['TEXT']
key=str(j['stuff']['time'])
j['id']=':'.join([fmcall,tocall,key,str(j['freq'])])
traffic[key]=json.dumps(j) is the ASCII JS8 message pulled from , which pulls from the API of the JS8 software. After this step, the text in is placed onto the page using Javascript. These steps are fine. The issue occurs in the change in context because there is an assumption that the JS8 traffic, already fully processed by the JS8 software, is ready to go and will not affect the context of the webpage. This is the behavior that we can then exploit. j['stuff']['params']['TEXT'] collector.py traffic[key] From start to finish, our attack looks like this: https://securityinnovation.hubs.vidyard.com/watch/dEaxwfcKAopxUVnVeMQtbf?embedable=true A few minutes later, our message is logged on the website... The end result is mostly cosmetic. This is a public page, so there’s no session cookies to steal or controls to spoof. Stored XSS is a real possibility too, but after a frustrating morning sending many, many time-consuming payloads (each JS8 message takes several minutes to send) we couldn’t get working Javascript that would execute on the page. I suspect that the JS8net software accidentally blocked many of the key characters and words and our workarounds didn’t seem to fire. Nevertheless, Burp Suite came in handy here. The ionosphere was cooperative that particular day and bouncing signals pretty well. I knew from other tools that stations in other countries were hearing JS8 traffic from the U.S.. So my next payload was This URL points to a DNS and HTTP listener run by Burp Suite’s Collaborator tool, which we often use during penetration tests for finding out-of-band information leaks. This was no different. Within a few minutes, DNS and HTTP traffic was recorded by the Collaborator Server from users visiting the page in Chile. I also viewed the page to inspect the injection and was logged as well. KJ7YLS: @ALLCALL <img src="http://727k2w1hfoamqewpm7rpiocu0l6cu2ir.oastify.com" alt="@HB DN13"> This was about as far as I wanted to ethically go with the injection. I reported the issue to the website’s owner, Jeff, with suggestions on remediation. He got back to me the next day, saying: While I waited for the patch to go live, I reflected on a few lines from the JS8Net README: I work in security myself (I do R&D for a network security company in the Bay Area), but I'll have to admit that submitting JS via radio to hack a web site was totally off my radar. It's important to note that this part of the software is still very much in the development stage, and may have critical vulnerabilities that make exposing the exposed services to the open Internet a Very Bad Idea. While it certainly will work, it's intended for protected, internal LAN use at this time. Honestly this is an excellent warning in general, especially for projects that are in progress and have not been thoroughly tested. Vulnerabilities at this point are an “unknown unknown” but the author was primarily thinking about the exposed listeners and APIs in his software. However, we exploited a slightly different type of problem. The README warns that the service should be run inside a LAN and this would indeed protect others from HTML injections and defilement of the webpage. However, a payload with Collaborator payloads would leak the public IP address of anyone viewing the page within their private LAN as well, so that’s a little harder to address. In short, this is a radio signal attacking a webpage on the Internet. An attacker doesn’t need to fool around with VPNs, Tor, or botnets to try to hide their identity on the Internet. JS8 is so effective at extracting messages -24dB below the noise floor (the whistling literally cannot be audibly heard at this level) that very little power is needed to reach distant stations. One watt of transmission power, on good ionospheric conditions, can go coast-to-coast across the U.S.. An attacker could be anywhere in the world. A burst message is all that is needed, so direction-finding would also be difficult. I think that’s about as close to untraceable as you can get with something like this. Timeline: July 13: discovered the issue, reported to Jeff, applied to MITRE for a CVE July 14: Jeff responds. July 22: Jeff applies a patch to JS8Net on Github. July 25: The patch goes live on the website. Aug 18: the blog post is published.

Attacks Over The Air — Phreaking HTML Injection

বাতাসে আক্রমণ - এইচটিএমএল ইনজেকশন

Angriffe über Funk – Phreaking-HTML-Injection

Ataques por aire: inyección de Phreaking HTML

Attaques en direct — Phreaking HTML Injection

हवा से हमले - भयभीत करने वाला HTML इंजेक्शन

無線攻撃 - 異常な HTML インジェクション

공중파 공격 - HTML 인젝션을 위협하다

Ataques Over The Air — Phreaking HTML Injection

Havadan Saldırılar — Phreaking HTML Enjeksiyonu

Tấn công qua mạng — Phreaking HTML injection

空中攻击 — Phreaking HTML 注入

Beyond Technology: Blockchain as the Philosophy

প্রযুক্তির বাইরে: দর্শন হিসাবে ব্লকচেইন

Jenseits der Technologie: Blockchain als Philosophie

Más allá de la tecnología: Blockchain como filosofía

Au-delà de la technologie : la blockchain comme philosophie

प्रौद्योगिकी से परे: दर्शनशास्त्र के रूप में ब्लॉकचेन

テクノロジーを超えて: 哲学としてのブロックチェーン

기술을 넘어서: 철학으로서의 블록체인

Além da tecnologia: Blockchain como a filosofia

Teknolojinin Ötesinde: Felsefe Olarak Blockchain

Ngoài Công nghệ: Blockchain là Triết lý

超越技术：区块链作为哲学

Unveiling the Nexus: Blockchain in the Context of Contemporary Philosophical Theories

Blockchain in terms of philosophy: From Plato to Foucault

Unchaining the Potential: Exploring Philosophical Implications of Blockchain

Catching signals from others is how we started communicating as human beings. It all started, of course, with our vocal cords. Then we moved to smoke signals for long-distance communication. At some point, we discovered radio waves and are still using them for contact. This article will describe how you can tune in using and an SDR dongle. Fedora Linux My journey I got interested in radio communication as a hobby when I was a kid, while my local club, LZ2KRS, was still a thing. I was so excited to be able to listen and communicate with people worldwide. It opened a whole new world for me. I was living in a communist country back then and this was a way to escape just for a bit. It also taught me about ethics and technology. Year after year my hobby grew and now, in the Internet era with all the cool devices you can use, it’s getting even more exciting. So I want to show you how to do it with Fedora Linux and a hardware dongle. What is Ham Radio Amateur Radio (ham radio) is a popular hobby and service that brings people, electronics, and communication together. People use ham radio to talk across town, worldwide, or even into space, without the Internet or cell phones. What’s SWLing? To broadcast with your ham radio or SDR system, you need to obtain a license from a governmental body. But to intercept signals and listen to the open communication between two amateur radio stations, you don’t need one. The term SWLing comes from the abbreviation of Short Wave Listener, where you listen to stations communicating in the shortwave bands between 3 and 30 MHz. This can be used for long-distance communication using the , a layer of the Earth’s atmosphere. ionosphere To get started, you don’t need a license. Still, I recommend getting yourself an SWL sign to identify yourself in a listening contest. These are competitions for categories like who will discover the most connections in a month or who can listen to contacts from each country in the world. How to get an SWL Sign? There are two options: Contact your national radio club and ask them to issue one for you. I got my Czech one, OK1-36568, after a few weeks. Join the community and request a sign there. Short Wave Amateur Radio Listening You will get more information and help from either of these locations if you get stuck in some fashion! QSL Cards You can also use your sign to send QSL cards via post or electronically. This is a great way to communicate with people worldwide and make friends. Per Wikipedia, A QSL card is a written confirmation of either a two-way radio communication between two amateur radio or citizens band stations; a one-way reception of a signal from an AM radio, FM radio, television, or shortwave broadcasting station; or the reception of a two-way radio communication by a third party listener (in our case). A typical QSL card is the same size and made from the same material as a regular postcard; most are sent through snail mail. Replace the radio receiver with your Fedora Linux The focal point of the ham radio hobby is the radio transmitter/receiver. Most of the time, enthusiasts build their radio from scratch, but this differs from what I will write about here. SDR A software-defined radio (SDR) system is a radio communication system that uses software for the modulation and demodulation of radio signals. In other words, a piece of hardware and software replaces a radio transmitter/receiver. This helps you discover more in a way you are familiar with – a User Interface with built-in functions instead of the limited interface of a radio receiver. My explanation oversimplifies things, so if you want to go deep and read more about SDR, here is an excellent start. SDR Set Up under Fedora Linux Choosing the proper hardware If you search the Internet for an SDR dongle, you’ll find many ideas depending on your budget. In this tutorial, I’ll work with the one I have, which works well under Fedora 37. A note: The dongle covers frequencies from 25MHz to 1750MHz, which doesn’t cover the Short Wave bands. You would need an additional device to listen to them. This is included in the package I linked above. Some other hardware providers offer all-in-one products. Check if the dongle is visible Before installing anything, detect whether Fedora Linux recognizes your USB dongle. I hope you didn’t buy a fake one :-). Use the following command to list the USB devices on your system. lsusb One of the output lines (in the case of Nooelec) should be Realtek Semiconductor Corp. RTL2838 DVB-T Now proceed by installing the software you need Fedora offers a set of tools and drivers packaged as a group. Even though you would not use all the components in this package from the beginning, I recommend installing it. You’ll have more software to play with. sudo dnf group install 'Electronic Lab' I advise you to explore what’s in the group by running this command: sudo dnf group info 'Electronic Lab' Now check if you have everything set up correctly by running: rtl_test You should see something like this: Do not forget to kill this process because the device will be busy and cannot be used in the next step. A simple Ctrl + c works. Gqrx You have the dongle already in your device’s USB port and all the software you need to get started. Now it’s time to intercept your first signal. Start the program called . Don’t be alarmed by the strange interface. You’ll get used to it. Gqrx Configure the I/O Device Screen From the “Device” Dropdown, select the ‘ .’ RealtekRTL2838.. Leave the rest untouched for the moment. If you don’t see your device there, click the “ ” button at the bottom of the screen. Device Scan When your device is selected, click “OK,” and the dialogue will close. Configure the frequency screen Before you start intercepting signals, ensure there is something out there that proves everything works correctly. Since the dongle covers the FM radio band as well, do this: Locate your favorite radio station’s frequency. Mine is 105MHZ Set it in the Frequency field Select WFM (stereo) in the “Mode” dropdown. If you don’t do this, you will hear a sound. not Play And now, you need to start the reception by clicking the “play button” in your main menu. You will see the frequency visualized like this: If you hear a sound, everything will move to the next step. Check if everything is set up correctly if you don't hear anything. You may ask a question in the comments for this article; I can direct you to the proper forum to solve this. Feel free to play with some more FM broadcasts. You have the antenna for it in your pack. Let’s go Short Wave In the case of the Nooelec, you need to add one more device to the USB dongle and turn it on. Instructions on how to do that are included in the package you receive. In short, you plug the “Up Converter” into your USB dongle and make sure the switch is in the “convert” position. Some videos are available on how to do it if you get stuck. You will need an antenna and a good location Now things get trickier. If you live in an area where you don’t see an open space out your window or other buildings surrounding your building, you might have trouble catching a Short Wave radio amateur signal. Let’s try this to see if it works Try to be in the open. I usually listen from my terrace, which could be better but works under particular conditions. You would need a long wire to act as your antenna apart from the hardware. Try the antenna with the hardware initially – the telescoping one from , but it will catch only powerful signals. Nooelec Let’s go back to Gqrx Now with the converter, you need to make some changes to your device screen: Please note the – for the . This is required for the Up Converter to work. 125Mhz LNB LO field Tune your frequency to 14.100 Mhz and make sure your Mode is (standing for ) because this is this band’s main demodulation option. USB Upper sideband Then go to your screen, use the zoom slider, and set it to see about . In our case, you should have between 14.05 to 14.15 Mhz on your screen. FFT Settings 100 kHz Also, click the “ ” to see the information about the SW bands you are exploring. Enable Band Plan Then hit the play button and explore the space between 14.0 and 14.3 Mhz to get any amateur radio transmission. When intercepting a transmission, adjust your settings to improve your listening experience. It’s a journey that you have already started. Most probably, you will hear something like this: “CQ CQ CQ this is ..(followed by the radio license number spelled with the ). ham radio phonetic alphabet Listen very carefully, and by the call sign, you can determine the location of the radio amateurs’ country. You can visit the to learn more about them and even send them a QSL card confirming their connection. QRZCQ website . Keep the momentum going Now you have some tools and ideas for starting Short Wave Listening. This is the first step of an incredible and exciting journey you can have together with your Fedora Linux OS. You will discover the pleasure of , reading more about , how to be a part of a listening competition, and what mean. building your antenna for the specific band how the ionosphere helps those Q-codes This article was initially published in Fedora Magazine

Mastering Shortwave Listening (SWL) with Fedora Linux and Software Defined Radio

Art NFTs in the Tech Sphere in 2024

Stories, News & Mentions about IOSPHERE

Iosphere’s Stories on HackerNoon