My New Clock

Necessity is the mother of invention. My apartment building has an indoor swimming pool that I like to swim laps in. Some time last year, building management took down the wall clock that hung at the end of the pool. This drove me to figure out alternatives and since I could see my apartment windows from the pool I decided what I needed was a large clock.

I crack open box of my electronics stuff and start taking inventory. My plan is to use the chips I have to drive 7-segment displays to drive a home-built over sized 7-segment display. Think old school game shows before everything became LCD screens.

I start with a breadboard, add a 7-segment display and a CD4511 7-segment display driver chip, and wire it to a USB battery. Great success as I can display all the numbers I need by changing around the jumper wires.

Next step I hookup an Arduino and control the inputs that way. It looks like I have my successful proof-of-concept.

The first real problem I encounter is how do I build the clock circuitry and it looks like that's going to harder than the display component. Things change as I find out the ESP32 can be used with Arduino IDE and I can have the ESP32 call out to an NTP time server and set its own internal clock.

Now I have the clock and the display drivers all that remains is building the numbers and figuring how how to power thing without burning out my logic chips.

I start my research into different ways to drive large, bright LED displays and I come across NeoPixels RGB strips.They can cut with scissors and soldered in a chain easily. I do the math on how many LED's I need and I order a 100-LED strip from Amazon.

I get the strand in the mail and right away start playing with it by hooking up power and data lines. Nothing happens. This is real bummer, I take out my multi-meter, check power levels, check the connections, everything seems fine. After a while of confusion and frustration I come up with the idea to plug wires into the other end of the strip and everything lights up. I run sample program and it's magical, I ever think I hear music playing (probably just in my head). This will work.

Actual construction begins and the first thing I need is a box to mount the digits in. After some searching and head scratching I decide the perfect box will be the tray from a case of water bottles so I run out to Target late that night to pick up some paint brushes and black paint. After the paint dries,  I cut out paper outlines to size display, mark rectangles with pencil and then start cutting the LED strip into 4 light segments; no turning back now.

Laid out the first digit, cut the lengths of wire, soldered one segment to the next until the whole first 7-segment display built. The moment of truth comes as I mount it in the box, tape it down with electrical tape and plug it in.

And it kind of works. Re-solder some flaky joints and I have myself a device that display any number between 0 and 9. Thirty-two careful wire solders later (not counting re-solders) and I have myself a working clock display.



I finished up by moving the ESP32 and the LED power supply to the right size breadboard and mounting it to the back of the box. Wrote the code in the Arduino IDE and put it on GitHub (https://github.com/tachyonknave/NeoClock_ESP32). Final step was testing it from the swimming pool and it was perfect.

Future plans: Add a flashing dots between hour and minute. Set up a web server to control it over WiFi that will allow additional functions such as 20 second countdown for heartbeat, show the date periodically, timer mode to count up or count down, change the colors and switch between 12 and 24 hour mode.

Added wax paper to diffuse the LED's and significantly improve readability. 

View from the Pool

How to and why use VirusTotal

Most people have an anti-virus program running on their PC, continually scanning for known malware. That's a good idea but what about unknown malware? Unknown malware could be malware that is known to other scanners but not the scanners you're using. Or even worse, malware could be known to your scanner but not malware definitions list on your machine? What then?

Of course you should have your malware definitions list automatically update,  but what if you could scan suspicious files with 60+ scanners, all them are up to date? That's where VirusTotal comes in. It's a free tool that scans files for bad stuff like malware. You wouldn't use VirusTotal to scan all your files, but it's perfect for one or two suspicious files, especially files you receive via e-mail or other questionable sources.

How to Use VirusTotal: Scan Types

There are two ways in which you check a file against VirusTotal. If the file is under 250MB you can upload it. The other option is you can take a hash* of the file and send that hash to VirusTotal.

To take the hash of the file you can use many tools. For example, here's a PowerShell command:

Get-FileHash C:\sol.exe -Algorithm SHA1 | Format-List

There are several tools available on the Internet to take a hash of the file, and  you should check them before you use any. I occasionally use Microsoft's FCIV. 
 
VirusTotal accepts hashes from the following algorithms: md5, sha1, or sha256.

Copy the hash part and paste into the VirusTotal search box

VirusTotal Search

If VirusTotal recognizes the file then, that's great news. If it doesn't, you need to assess whether the file contains any sensitive info (like your e-mail or software license assigned to you). Personal files such as documents and spreadsheets should not be uploaded to VirusTotal. Part of the deal you make with VirusTotal to use their service is that they don't keep the files you upload private, so always keep that in mind.

Results 

Most times you will get results like this, where nothing is found:

For comparison here is a bad result:

If this happens, delete the file without running it.

False Positives 

Unfortunately there is always the possibility of false positives, which is when some scanners will say the file is bad while other scanners say it's good.  My rule of thumb:  if Microsoft, Symantec and McAfee all say the file is good, it's probably be okay, but if one of them says it's bad, don't trust it.

Misc

VirusTotal also offers a REST API to check hashes or files. It most cases this would be overkill. A special script could be written to go through every file in a directory, generate its hash and send that hash off to VirusTotal. However, VirusTotal does limit how many files and how often you can send files to the API with a free account, so you can't use it to scan all the files on your hard drive. In some instances you should be using a local scanner for instead, and VirusTotal isn't a replacement for those times.  


The following blog post by JC_SoCal offers a reason why you may not want to upload a file or hash to VirusTotal for you to consider.

Malware Analysis #1 Protip

Unless you are a malware analyzer or think you are being directly targeted you'll be okay. 

Conclusion

Using this post you should know everything you need to know to be a basic VirusTotal user. VirusTotal is a great tool to have in your cyber protection toolbox. 






*hash - a hash is the output of a special mathematical function used to assign an id to a file or a message.  ( Wikipedia - Hash Function )

InfoSec News

One of the most important things for a  professional to do is keep up with the latest cybersecurity news and alerts. Below are a list of blogs and twitter users I follow. I use feedly.com to aggregate the blogs.

Google Online Security Blog
HackRead
Krebs on Security
SANS Internet Storm Center
Schneier on Security
The Hacker News
US-CERT Current Activity
E Hacking News
Errata Security
Graham Cluley
Hackmageddon
Have I Been Pwned

Malwarebytes Labs
Open Web Application Security Project (OWASP)
security - Ars Technica
TaoSecurity
The Register
TrendLabs Security

Twitter Handles to Follow

@RGB_Lights
@climagic
@VessOnSecurity
@2sec4u
@nostarch
@briankrebs
@DFIRTraining
@sempf
@markrussinovich
@azeria_labs
@secureideas
@x0rx
@jessfraz
@eric_conrad
@Fox0x01
@malwareunicorn
@malwrhunterteam
@swiftOnSecurity
@MalwareJake
@kevinmitnick
@Code_analysis

@OnRyanmac