11 ms·

Long-Range (200m) BLE Beacons with 1Mb EEPROM

47 points by jimiasty 10y ago

jimiasty 10y ago
Hi HN, this is Jakub, founder of Estimote, Inc. (YC S13). We just released a new revision of our Location Beacons. We implemented new, low power Nordic nRF52 chip and extended range to 200 metres (+10dB). Beacons can simultanously advertise both iBeacon and Eddystone packets as well as telemetry & sensor data + they have built-in GPIO slot. There is also 1Mb EEPROM, so you can read/write data directly in the beacon. You can read more on our blog: http://blog.estimote.com/post/149362004575/updated-location-beacons-200-m-range-nfc-new http://blog.estimote.com/post/149362004575/updated-location-... I will be more than happy to answer any questions here.
- scartracs 10y ago
  My power is out so I can't browse too much atm. I vaguely remember the Google beacon being a always-on notification that launched a website link pressed. How well does that work in android and iOS? Would it be feasible to make an "SOS help" beacon and expect every phone nearby to be notified or similarly spammed with an ad message?
- erichocean 10y ago
  I wish they were actually programmable. The available programmable BLE hardware is a bit clunky (I'm using stuff from RedBearLabs currently).
Animats 10y ago
These should be great for attackers - a long-range Bluetooth device with years of battery life. Reprogram these for the MouseJack attack.[1] Get a bag of 50 and spread them around. Profit! If you want to attack a specific company, spread them around that company's building and nearby restaurants. If you repaint them, who's going to notice an extra rock in the landscaping? If the "remote updating for fleet management" can be attacked, you don't even need to buy them; you can take over other people's. [1] http://www.computerworld.com/article/3037377/security/mousejack-billions-of-wireless-keyboards-mice-vulnerable-to-15-hijack-attack.html http://www.computerworld.com/article/3037377/security/mousej...
- fulafel 10y ago
  MouseJack was targeting vulnerabilities in non-BT mice and keyboards, like those using the Logitech dongles. BT pairing prevents trivial MITM attacks.
- edgartaor 10y ago
  I'm not sure if I understand how these devices can be used to attack. Can you explain it in more detail?
  - Animats 10y ago
    Bluetooth devices can do MITM attacks on anything with a wireless keyboard or mouse. This device isn't designed to do that, but it's a programmable long-range Bluetooth device designed to be unobtrusive, so it's hardware that can be repurposed for an attack.
    - BHSPitMonkey 10y ago
      I don't think the beacons are "programmable" in the sense you think they are. They have a protocol which allows for configuring a root password and changing the string that it broadcasts, but it's not like you can install a different Bluetooth stack or profile (short of some profound vulnerability, but the same could be said for a pair of Bluetooth headphones).
      - bigiain 10y ago
        They might not be intended to be, but from their dev site: "Estimote Beacon is a small computer. Its 32-bit ARM® Cortex M0 CPU is accompanied by accelerometer, temperature sensor, and what is most important—2.4 GHz radio using Bluetooth 4.0 Smart, also known as BLE or Bluetooth low energy." And from here: http://makezine.com/2014/01/03/reverse-engineering-the-estimote/ http://makezine.com/2014/01/03/reverse-engineering-the-estim... "The Estimote is built around the Nordic Semiconductor nRF51822, which explains their presence on the Nordic booth at CES. It’s a nice chip, basically a 32-bit ARM Cortex M0 CPU with 256KB of flash and 16KB of RAM with a built-in 2.4GHz radio supporting both Bluetooth LE as well as 2.4GHz operation—where the 2.4GHz mode is on air compatible with the nRF24L series products from Nordic." They might not be "easily programmable", but how much would you be against Travis Goodspeed being able to do something similar to what he's done here with an Estimote beacon? http://travisgoodspeed.blogspot.com.au/2011/02/promiscuity-is-nrf24l01s-duty.html http://travisgoodspeed.blogspot.com.au/2011/02/promiscuity-i... (You can't see it very well in the image in the Makezine article of the board, but under the "CH3" in the label for the smaller chip is a 4 pin header that I'm 99.9% sure will be a jtag header...)
guiomie 10y ago
This is really cool, but I can't figure out a use case to buy any :/
- zump 10y ago
  Said everyone working in IoT.
- skewart 10y ago
  Yeah, like a sibling comment suggests, beacons are definitely in the bottom of the trough of disillusionment on the Gartner hype cycle chart. There is a ton of potential for them though, but perhaps more in the autonomous vehicles and robotics space than in the realm of current consumer devices. Of course, there are plenty of competing technologies in the micro-location space. Making beacons more computationally powerful beyond just broadcasting a UUID is an interesting development, and one competing tech, like location fingerprinting, can't easily do.
  - calgoo 10y ago
    Yea I can see usage for big shops like wallmart etc where its next to impossible to find something if you dont know the store. Image if these where available for each area, and you just put in what you are looking for and it guides you to the correct section.
    - rasz_pl 10y ago
      imagine this would work great .. if cellphones on the market were equipped with location tracking phase arrays instead of piece of wire for antenna.
- rasz_pl 10y ago
  You can place them in physical locations and let users download your app that will trigger when it sees them, it almost makes sense versus app with GPS coordinate list, almost ....
gortok 10y ago
How can these devices pass BLE certification and go to +10dBm?
- rasz_pl 10y ago
  ? its only 10mW, old BT Class 1 goes up to 100mW (20dbm)

47 points by jimiasty 10y ago

Hi HN, this is Jakub, founder of Estimote, Inc. (YC S13). We just released a new revision of our Location Beacons. We implemented new, low power Nordic nRF52 chip and extended range to 200 metres (+10dB). Beacons can simultanously advertise both iBeacon and Eddystone packets as well as telemetry & sensor data + they have built-in GPIO slot. There is also 1Mb EEPROM, so you can read/write data directly in the beacon. You can read more on our blog: http://blog.estimote.com/post/149362004575/updated-location-beacons-200-m-range-nfc-new http://blog.estimote.com/post/149362004575/updated-location-... I will be more than happy to answer any questions here.

scartracs 10y ago
My power is out so I can't browse too much atm. I vaguely remember the Google beacon being a always-on notification that launched a website link pressed. How well does that work in android and iOS? Would it be feasible to make an "SOS help" beacon and expect every phone nearby to be notified or similarly spammed with an ad message?
erichocean 10y ago
I wish they were actually programmable. The available programmable BLE hardware is a bit clunky (I'm using stuff from RedBearLabs currently).

Animats 10y ago

These should be great for attackers - a long-range Bluetooth device with years of battery life. Reprogram these for the MouseJack attack.[1] Get a bag of 50 and spread them around. Profit! If you want to attack a specific company, spread them around that company's building and nearby restaurants. If you repaint them, who's going to notice an extra rock in the landscaping? If the "remote updating for fleet management" can be attacked, you don't even need to buy them; you can take over other people's. [1] http://www.computerworld.com/article/3037377/security/mousejack-billions-of-wireless-keyboards-mice-vulnerable-to-15-hijack-attack.html http://www.computerworld.com/article/3037377/security/mousej...

fulafel 10y ago
MouseJack was targeting vulnerabilities in non-BT mice and keyboards, like those using the Logitech dongles. BT pairing prevents trivial MITM attacks.
edgartaor 10y ago
I'm not sure if I understand how these devices can be used to attack. Can you explain it in more detail?
- Animats 10y ago
  Bluetooth devices can do MITM attacks on anything with a wireless keyboard or mouse. This device isn't designed to do that, but it's a programmable long-range Bluetooth device designed to be unobtrusive, so it's hardware that can be repurposed for an attack.
  - BHSPitMonkey 10y ago
    I don't think the beacons are "programmable" in the sense you think they are. They have a protocol which allows for configuring a root password and changing the string that it broadcasts, but it's not like you can install a different Bluetooth stack or profile (short of some profound vulnerability, but the same could be said for a pair of Bluetooth headphones).
    - bigiain 10y ago
      They might not be intended to be, but from their dev site: "Estimote Beacon is a small computer. Its 32-bit ARM® Cortex M0 CPU is accompanied by accelerometer, temperature sensor, and what is most important—2.4 GHz radio using Bluetooth 4.0 Smart, also known as BLE or Bluetooth low energy." And from here: http://makezine.com/2014/01/03/reverse-engineering-the-estimote/ http://makezine.com/2014/01/03/reverse-engineering-the-estim... "The Estimote is built around the Nordic Semiconductor nRF51822, which explains their presence on the Nordic booth at CES. It’s a nice chip, basically a 32-bit ARM Cortex M0 CPU with 256KB of flash and 16KB of RAM with a built-in 2.4GHz radio supporting both Bluetooth LE as well as 2.4GHz operation—where the 2.4GHz mode is on air compatible with the nRF24L series products from Nordic." They might not be "easily programmable", but how much would you be against Travis Goodspeed being able to do something similar to what he's done here with an Estimote beacon? http://travisgoodspeed.blogspot.com.au/2011/02/promiscuity-is-nrf24l01s-duty.html http://travisgoodspeed.blogspot.com.au/2011/02/promiscuity-i... (You can't see it very well in the image in the Makezine article of the board, but under the "CH3" in the label for the smaller chip is a 4 pin header that I'm 99.9% sure will be a jtag header...)

guiomie 10y ago

This is really cool, but I can't figure out a use case to buy any :/

zump 10y ago
Said everyone working in IoT.
skewart 10y ago
Yeah, like a sibling comment suggests, beacons are definitely in the bottom of the trough of disillusionment on the Gartner hype cycle chart. There is a ton of potential for them though, but perhaps more in the autonomous vehicles and robotics space than in the realm of current consumer devices. Of course, there are plenty of competing technologies in the micro-location space. Making beacons more computationally powerful beyond just broadcasting a UUID is an interesting development, and one competing tech, like location fingerprinting, can't easily do.
- calgoo 10y ago
  Yea I can see usage for big shops like wallmart etc where its next to impossible to find something if you dont know the store. Image if these where available for each area, and you just put in what you are looking for and it guides you to the correct section.
  - rasz_pl 10y ago
    imagine this would work great .. if cellphones on the market were equipped with location tracking phase arrays instead of piece of wire for antenna.
rasz_pl 10y ago
You can place them in physical locations and let users download your app that will trigger when it sees them, it almost makes sense versus app with GPS coordinate list, almost ....

gortok 10y ago

How can these devices pass BLE certification and go to +10dBm?

rasz_pl 10y ago
? its only 10mW, old BT Class 1 goes up to 100mW (20dbm)