sunnuntai 13. heinäkuuta 2014

Raspberry Pi Model B - driven LED scroller project [updated 25.10.2014]

Foreword


(First of all, let me apologize the fact that it's been short of a year since I've last posted stuff here.)

The Finnish summer is currently clocking in at 23 degrees Celsius and rising (75F). My current apartment does not have any active AC, so I will have to make do with a simple oscillating floor-stand 19" fan behind my back (beware, this is the recipe for persistent neck ache!) 

My latest project saw its birth a few days, as I acquired a Raspberry Pi Model B from a co-worker.

For those of you that are unaware of the product, the Raspberry Pi ('RPMB' from now on) is an embedded, extremely afforable and hackable / extendable SoC (System-On-a-Chip) product - with an ARM11 700 Mhz CPU core. The most interesting feature for me (and for many others) was the availability of fully documented and extendable General Purpose I/O pins (GPIO), located in the lower right corner of the board:


Yes, that's the good stuff in the lower right. (Image credit: http://nwazet.com/)

The RPMB I got from my co-worker had a hard plastic case made for the Raspberry Pi, which he was kind enough to include for the price I paid. 

The project itself - the prerequisites


I came up with the idea for this project with some of the other team members at my current employment. We've already implemented the Jenkins Continous Integration application for our principal product. Along the features Jenkins offers is the ability to track concurrent "build pipelines" or, "code builds combined with parameterized scripts and subsequent task triggers", if you will. 

Jenkins offers a nice status view for the state of each build pipeline and task. This status view can be of course displayed on any external monitor for all of the team members to see. (Which is what we were going to do anyway). 

Since an ever-updating HTML page is somewhat boring when combined the daily routines of software development, I came up with an idea to add a physical LED scroller alongside the Jenkins build status window. 

LED scrollers / matrices are basically huge amounts of single LEDs soldered onto a circuit board and controlled by IC's and various other components. This allows very bright displaying of colors, messages, animations and whatever one can think of. 

After some hours of looking up information on the aforementioned subject of LED matrices, I decided I would need one that could display about three different colours (green for "success", red for "failure", orange for "???"). I also discovered that in order to provide stable current to the LED matrix, the power supplied by RPMB's GPIO pins would not be enough. Therefore a separate power source for the LED matrix would be needed as well.

On the software side of things, Jenkins offers a convenient REST API for polling build pipeline statuses, which leaves me only the trouble of writing some shell scripts / Python code to actually communicate the build data back to the RPMB.

Parts / hardware needed / tech stuff


I came up with a list of hardware and tools required for this project, and the moment it is as follows (the bolded ones I already have):

-   1 x Raspberry Pi Model B with black hard plastic casing
-   1 x power supply for above, capable of outputting at least 2A continously
-   1 x RGO LED matrix module ( "LDP-8008")
-   1 x power supply for above, capable of outputting at least 2A continously (D-Link DC adapter)
-   1 x RPMB GPIO breakout module with ribbon cable
-   1 x plexiglass / plastic casing to house the entire completed project
-  a soldering iron
-  Leatherman Juice CS4 multitool
-  spare wire with 2.5mm diameter
-  1 x HDMI cable
-  1x MicroSD card + SD adapter for Raspberry Pi operating system 

I found out that the LDP-8008 LED matrix module I bought (see below) has the following pinout in relation to RPMB GPIO pins (source: http://www.raspberrypi.org/forums/viewtopic.php?f=41&t=67520):

! Updated 21.7.2014: new, corrected pinout from similar blog entry (http://kimondo.co.uk/raspberry-pi-led-scrolling-sign/):

Raspberry Pi pin number (GPIO pin label)LDP-8008 pin number (label)
3 (GPIO 2)2 (A row address)
5 (GPIO 3)4 (B row address)
6 (GND)5 (GND)
7 (GPIO 4)6 (C row address)
8 (GPIO 14)7 (EN enable display)
10  (GPIO 15)8 (D row address)
11 (GPIO 17)9 (red LED)
12 (GPIO 18)10 (green LED)
13 (GPIO 27)14 (latch)
15 (GPIO 22)16 (shift)
Here's a spreadsheet outlining the "correct" GPIO layout on the Model A and B ( linked  for fair use from http://www.bytecreation.com/blog/2013/10/13/raspberry-pi-ultrasonic-sensor-hc-sr04 )

Looks easy enough?

Project progress log, in chronological order (date)


Friday, 11.7.2014


Start of the project.

I bought a Fuji:tech 2 x USB port (2A) AC -> USB  power adapter from Verkkokauppa.com (about €19). 

The first 2A USB power output is currently powering up the RPMB itself with a USB -> MicroUSB cable. I plan to wire up the second output to power up the LDP-8008 LED matrix.

I ordered some of the other parts:

LDP-8008 LED Matrix module (from eBay, €32.70)
RPio Raspberry Pi Paddle Breakout Board (from MODMYPi, about €10 with shipping)

Both of these items are shipping from the UK and I expect them to arrive to Helsinki in about 4-5 working days. Meanwhile, I'll concentrate on the things I can already do to further the project.

Saturday, 12.7.2014


The initial start-up and installation of Raspbmc was a piece of cake, with the unit being up in minutes:


Right after I had verified that the unit works and configured some basic settings, I observed that the plastic case my co-worker had provided with the RPMB had no cut-out / hole for the GPIO pins. But since the case was detachable, I decided to use my trusty soldering iron and Leatherman tool and cut out the required hole myself.

First of all - I removed the casing to determine which side to cut (lower right side). I marked the area around the wall next to the GPIO pins using a sharp knife, so I would know how much to cut, without exposing too much of the internals, or the component video out connector nearby. 

I fired up the soldering iron and started to melt the plastic slowly with the tip, with the earlier mentioned floor fan blasting towards the working area to a window opening (ventilation is important here, you DO NOT want to inhale any of the fumes produced!). I ended up melting away a 3cm by 1.25cm piece of plastic, which snapped off easily - after the edges had been weakened with the soldering iron diving into the plastic like a hot knife in a piece of butter

Looks like a mess, but after using the nail file it turned out well:



My reasons for using the soldering iron were two-fold; first I did not want to risk the whole casing snapping in two by trying to pry the damn thing away with the Leatherman alone. Second, the soldering iron melted the plastic in very steady and slow fashion, which was a nice plus since I don't have a laser CNC machine. After the edges of the piece to be removed had all but almost vaporized away, I applied some pressure and the thing came off easily. All that was left to do was to trim the excess sharp edges with a nail file, and the case modification portion for this project was done!

So I mounted the case back again: 


The end result is a bit crude looking at the moment, but this allows me to mount a ribbon cable to the GPIO pins and out of the side of the RPMB.

Monday 14.7.2014 --- Thursday 13.7.2014


Still waiting for the final parts to arrive. In the meantime, I visited Partco.biz for some tools, a new X-Acto knife and spare wire.

I also cleaned up and put together / salvaged from a drawer full of junk this makeshift soldering station / electronics working area:

Ready for everything.

I doubt that I have to solder a lot, but it's better to be safe than sorry, right?


Monday, 21.7.2014


The first part of the two items I ordered arrived via Itella (Finnish postal service) today. The LED matrix itself, LDP-8008 arrived in a surprisingly brand-new condition, given that the shipment method was regular airmail. 




The LED matrix came with a power cable (mountable with two Philips screws) and a 16-pin ribbon cable for actually controlling the LEDs. The next step is to dismantle one end of the ribbon cable, in order to attach the wires to the breakout board. That board (RP GPio Paddle Breakout Board, see my previous posts) and its attached cable will allow the LED matrix to be mounted more freely and independent from the RPMB. 


Stripped down version of the ribbon cable.

Once the last piece of the puzzle arrives, I can start assembling the thing. Also, I'm going to be looking for something to turn into a casing for the project.


Tuesday, 22.7.2014 


Building and connecting the parts


The breakout board arrived today. I wasn't expecting to receive the board so soon, but what the hell. Let the workshop begin!



The first, and easiest task was to connect the RPMB itself via the nice rainbow-colored cable. Note that the first pin in the GPIO pinout is located on the far edge of the circuit board, so make sure the cable orientation matches the one in the breakout board.



Second, there was the task of tediously connecting the I/O lines to the tiny spring-operated row connectors. (see above for pinout details). Pay special attention to the pinouts table, and don't trust the markings on the breakout board, they seem either wrong and/or outdated. If the ends of the ribbon cable we made earlier are too short to be connected into the row connector, solder a spare wire into it, and use that as a connection instead.

Topside view of the breakout board. Some of the labels are wrongly assigned, so check your connections using the table above.


I didn't have to solder anything, which is a plus nevertheless. The result is not very pretty one, but does work. The unused ribbon cable ends will probably have to be cut out later.


The LED matrix itself had two additional power connectors (VCC and GND), which I hooked up with a custom USB power cable I made using soldering on Monday. I only had the Fujitech power supply with two USB ports. I thought it could handle 2A on both ports, but I was wrong and after about four minutes the Fujitech power supply started cooking up and capacitors were making a lot of noise! I immediately cut power to all of the devices and  disconnected the faulty power supply.




This problem was most likely too low ampere output of the power supply, as the LDP-8008 manual states that the LED matrix unit can draw up to 2.5A continuously. So, regarding the power supply for both the RPMB and LED matrix unit, I'm back on the drawing board.

I spent about three hours checking all my wirings and connections.

Some quick test results


Finally, after hours of tweaking I managed to successfully output scrolling text with all available colors to the LED matrix! The thing is very bright with the additional power input connected, so I hope I can somehow control the brightness via PWM or some other way.

I recorded a short demonstration video [Google Drive link] . Here's a screenshot of the thing in action:

It's alive... green lights and red did look nice, too!

Currently, while writing this I seem to have a weird neck ache, so the software part of the project will have to wait - until my vacation kicks in (three days! THREE). 

Here are the commands that made the above video possible, was actually pretty simple - someone had already written a python routine for the LDP-8008, so I used it for testing that the LED matrix actually works. The final thing is going to be based on these libraries.  Re-inventing the wheel might not be worth it after all. I'll just stick to writing the REST polling Jenkins status monitor on top of the existing stuff. 
ate

- standard Raspbmc installation - SSH to the box with credentials: username "pi", password "raspberry" - sudo apt-get update- sudo apt-get upgrade- sudo apt-get dist-upgrade- sudoi apt-get update- sudo apt-get install python-dev python3-dev- sudo apt-get install build-essential
Use browser to download package: http://sourceforge.net/projects/raspberry-gpio-python/files/latest/download and place it into /home/pi/
cd /home/pi/
sudo tar xvf RPi.GPIO-0.5.6.tar.gz
cd <folder> you extracted the above package into
sudo python setup.py install
Make sure the LED matrix is powered up and connected correctly and run: 
sudo python scroll "Hello it seems the scroller is working (red) :) :) " 1sudo python scroll "Hello it seems the scroller is working (green) :) :) " 2 

Stay tuned for more! And don't forget to follow this blog with your own account!

 -- JH

Friday, 25.7.2014


I've just begun my vacation for this summer. Going to head out of Helsinki and out to the backwoods of Loppi, Finland (just about 50km West of Riihimäki, my hometown). Going to spend some time with my dad and go to sauna, swim as much as possible and generally relax and sunbathe. Last two weeks have been hectic at least, so it's always nice to chill and kick back a bit.

For the past few days, I've been working hard, and after my daytime job I've been building an enclosure for the electronics of the Raspberry Pi and breakout board. Since I couldn't find an affordable way to craft my own plexiglass/hard plastic casing with necessary cut-outs for the ethernet connector, microUSB power in / USB ports and SD card, I decided to create one from reusing stuff I had laying around the house.

The Samsung Galaxy S III retail box seemed adequate for the job, it has a removable lid and is made of cardboard, with a thin layer of insulating plastic sheet on top. After a few quick "does.it fit?" - type tests, the width of the box was almost exactly a match for that of the RPMB with the smaller case on, and the rest was a matter of aligning the ports properly, and cutting away correct sized pieces for the ports. The enclosure for the breakout board (on top in below image) is an ordinary cardboard box that was previously used for bulk sale of a CPU. I simply painted it matte black and cut holes for the GPIO connector cable and the ribbon cable for the LED display. The length of the latter cable is a bit of an issue at the moment (just short of 12 cm) but I hope to resolve this with some kind of an extension cable.

Here's what I came up with (the lighter is there for size reference):




This is what the larger enclosure looks like with the lid off:


What's missing as of now, is a more robust power source for the LED matrix and the software aspect of things; I hope to complete them during my vacation. So stay tuned, as always.

-- JH

Sunday, 19.10.2014


So some 3 months passed without any visible progress... but fear not, the project is not dead :) 

In the previous posts I was still looking for a permanent enclosure to house the RPMB and breakout board. Then, a few weeks ago, while going through some old stuff I found an old Elisa ISP cable modem laying around ("C5200"):

Image copyright: http://asiakastuki.elisa.fi 

What was interesting about this modem was that the enclosure was relatively easy to disassemble (held together only by a few Philips screws), and soon enough I managed to open up the unit vertically. I discarded the metal bottom plating and original electronics to make room for some of my own!

The plan was to mount the RPMB and breakout board vertically, utilizing some super glue, a hot glue glue pistol, wire binders and various recycled plastic parts. After some fitting, it seemed cool that the USB and network connectors of the RPMB would be accessible from the same location (bottom compartment) as the original connectors of the cable modem:


Image copyright: http://asiakastuki.elisa.fi

So... my original layout looked like this:


I super-glued some spare elastic in-ear headphone cushions to serve as a flexible but sturdy base to lay the breakout board on. I was originally planning to leave the RPMB top cover on, but this seemed unfeasible due to the unit heating up somewhat, so I wasn't sure how using a double enclosure was going to affect the running temperature. So I ended up removing the "lid."

I mounted the breakout board using a single screw with a square piece of hard plastic/cardboard, to prevent tension damage to the circuit board. After removing the RPMB lid, I superglued some more parts to secure it in place vertically, and used shortened wire binders ( and superglue) to secure it place horizontally. 

The end result looked something like this:



All that was left now was to put the original cable modem enclosure back together (using built-in clips), and testing that everything was still working!
Looks like I didn't break anything!


Nice hellish glow. I hope this is not a metaphor for the shape of things to come. Looks kinda like a furnace, actually...

The cable modem looks like the same thing as before, except that the internals have been completely replaced. I *could* stand the unit vertically but that would be too compact, no?

So right now the only thing left to do is to find a female<-->male 16-pin IDC extension cable (to allow the placement of the LED matrix unit further away from the enclosure), and finish the Python part of the project. I've already set up my Python development environment, and the project skeleton for the Python-Requests library, but that's about it for now.


Hopefully, in the next part the software side of things should be in alpha version at least!

-- JH

Saturday, 25.10.2014

I've studied and written some Python recently, and it looks like communicating with Jenkins  CI server is much more straightforward than I thought it would be. Aside from the standard Python 2.7.3 core libraries, I am using RPIO and Python-Requests, both of which simplify things very much.

I set up a Github repo for the project code, so feel free to send pull requests if you come up with cool fonts or animation logic for the LDP-8008.

https://github.com/JTHartikainen/jenkins-raspberrypi-scroller



-- JH

lauantai 9. marraskuuta 2013

Why you should use full disk encryption and replace Bitlocker with TrueCrypt

Introduction

In 2013, amidst the NSA mass surveillance program scandal, uncovered by Edward Snowden, it was also revealed that NSA backdoor operations are intentionally weakening existing encryption methods, for example AES (by NIST ). The other methods of surveillance used (optic fiber beam splitting, backdoors/master keys, brute force cracking of password hashes, forcing US-based CA's to hand data about issued TLS certificates' private keys) may vary, but the outcome is the same - NSA has irreversibly weakened the trust model of commonly used encryption components. Also, as indicated by revelations related to the PRISM data mining program, most large email and instant messaging providers are compromised, due to NSA having or planning to have direct access to the aforementioned service providers' data centers.

TrueCrypt and Bitlocker

Built-in into Windows 7 is a full disk encryption software, Bitlocker (though it is only available in the Enterprise edition). Bitlocker, utilizing AES and SHA-256, is relatively easy to enable and has been considered secure. Microsoft's official statement denies the existence of a backdoor in the software. It has, however, been suggested that master keys to bypass authentication exist in many proprietary FDE solutions. According to an ex-Microsoft employee, the FBI has requested the addition of a backdoor to Bitlocker at least once. But there is no substantial evidence of this.

Based on these findings, I decided to enable full disk encryption (FDE) for my personal laptop as an experiment. 

TrueCrypt, an open source FDE tool, offers three encryption algorithms: AES (also hardware-accelerated), Twofish and Serpent - and five combination algorithms. As indicated by image 1, AES is superior in terms of performance, when hardware acceleration is turned on. The benchmark was run on a Asus Zenbook UX32VD, with a Intel Core i7-3517U CPU. 

At this point we must make the decision to reject AES, for reasons described above. The benchmark clearly shows Twofish as the best alternative in terms of speed.

Image 1: benchmark run

Steps to enable TrueCrypt full disk encryption

Once TrueCrypt has been installed, the first thing you should do is making a backup of your critical data. The full disk encryption process will take a long time to complete and during this time several things can go wrong, which could result in data loss and corrupted partitions. Encrypting these backups, however, is outside of the scope of this post.

Note: If you're using a laptop, plug in the AC adapter to (avoid running out of battery) and make sure you've selected "Best performance" (click the battery/cord icon in the system tray on bottom right to view the options).

We can now start the full disk encryption process by navigating to the System menu in the TrueCrypt main screen, and choosing Encrypt system partition/drive

Note: If you receive an error with the message "Your system drive has a GUID partition table (GPT)", this means you have to disable UEFI secure boot in your computer's BIOS settings and try again. If that didn't work, the system drive's partition table type must be changed from GPT to MBR, which involves use of external tools (see this guide and follow the steps mentioned there).

1. First you are given the choice of normal and hidden volume (Image 2). The hidden option gives the user plausible deniability in case someone tries to force them to reveal the password. Let's just choose normal here:

Image 2: Choose whether you want plausible deniability or not.

2. After clicking Next, you have the option to select if you want to encrypt just the Windows system partition, or the whole disk (Image 3). It is recommended to encrypt the whole drive, but for my test purposes I chose to encrypt the Windows system partition only. Press Next after you've made your choice.

Image 3: Selection of encryption type.

3. TrueCrypt needs to know if you have more than one operating system installed (Image 4). If you have set up dual boot or triple boot environment, for example Windows on one partition and Linux on the other, select "Multi-boot".  Otherwise, select "Single boot".

Image 4: Choosing the number of operating systems.

4. The next dialog is the most important one (Image 5). Here you need to choose the encryption algorithm and hash type. As explained earlier, choose "Twofish" from the list and RIPEMD-160 as the hash algorithm and click Next.
Image 5: Choosing the encryption and hash algorithms.

5. Choose a password for the pre-boot authentication (Image 6). Maximum password length is 64 characters, but about 20 should be enough. If you find long passwords difficult to remember, you could use password management tools like KeePass 2. If you choose to use a key file, the file must be loaded from an USB drive during every boot. Keep that in mind. Click Next when you're done.

Image 6: Password selection

6. Move your mouse in random movements to generate randomness for the key generator, once you're done, click Next.

Image 7: Randomness generator

7. At this point you will be prompted to create a Rescue Disk image, and burn it into a DVD or CD. Follow the on-screen instructions, and you should end up with a .img file of your rescue disc, as well as burning it to DVD or CD. If your computer does not have an optical drive, you can use an emulator, for example Kernsafe TotalMounter. Using this rescue disk, you can recover a fully encrypted drive with a corrupt header. But bear in mind that corruption in key parts of the encrypted partition(s) can lead to total data loss.

Image 8: Rescue Disk verification.

8. Next, TrueCrypt needs to perform a "pre-test". This means your system drive's boot loader will be modified for TrueCrypt's purposes, and the computer will be rebooted. On boot, you are presented with a password prompt, enter the password you specified in step 5 and press Enter. The system should boot normally and TrueCrypt reports that the test was successful:

Image 9: Pre-test completed success message.

9. When you click Encrypt, the process of encrypting your files begins. Since we changed the algorithm from hardware-accelerated AES to Twofish, the process could take several hours. Make sure that your computer is running at maximum performance setting and that a laptop is operating on AC power. 

That's it! When encryption has been completed, reboot your machine and enter the password from step 5 to continue.

Conclusions

Your hard disk contents are now strongly encrypted. Assuming you don't write the password down anywhere, you can consider your files to be relatively safe. However, a number of more or less direct attacks against FDE are still possible, for example the cold boot attack unveiled in 2008. Performance using Twofish was found to be fair enough on the testing machine, and can be further improved by using SSD drives.