5 ms·

Now the question is if there is a exploit in the rom and by crafting your own audio you can make the device much more interesting.

by icefox 10y ago

freehunter 10y ago
The easier, hacker way is to intercept the traffic with a proxy: https://medium.com/@edwardbenson/how-i-hacked-amazon-s-5-wifi-button-to-track-baby-data-794214b0bdd8 https://medium.com/@edwardbenson/how-i-hacked-amazon-s-5-wif...
- daemonize 10y ago
  Similar approach taken for Amazon's Echo Dot exposing parts of setup process and some broken parts: https://medium.com/@dweinstein/amazon-echo-dot-explorations-part-1-5f5ae38ffeab https://medium.com/@dweinstein/amazon-echo-dot-explorations-...
- andrewstuart2 10y ago
  That only allows reacting to button pushes, though. I'm assuming that by default the mic is only active for initialization by default, but if you can get the microprocessor to execute arbitrary code via a crafted packet, you could presumably access the hardware directly and add more capabilities.
  - freehunter 10y ago
    If you have physical access to the hardware, it actually has exposed JTAG under the covers, and it's basically a Particle Photon, so I imagine you'd be able to have a lot of fun. Actually, here's a guide: https://learn.adafruit.com/dash-hacking-bare-metal-stm32-programming/overview https://learn.adafruit.com/dash-hacking-bare-metal-stm32-pro...
- simonjgreen 10y ago
  Minor thing, but there is no proxy at work here
- amelius 10y ago
  > Dash buttons are turned off most of the time to preserve the battery inside. They only turn on when you push them. And that means they have to re-connect to your Wifi network every time they are pushed. That’s easy to detect. How do they know for sure? Perhaps they also connect every month for a (status) update or for statistics, but this hacker just missed that. I wouldn't use these buttons to launch any missiles :)
  - tedmiston 10y ago
    Curious if anyone knows how the Dash buttons handle when your wifi password has changed since their last successful connect.
    - blacksmith_tb 10y ago
      I believe you have to use the mobile app to go through the Dash set up procedure again if you change your local AP (or get a new one, etc.)
tedmiston 10y ago
What do you mean?

Now the question is if there is a exploit in the rom and by crafting your own audio you can make the device much more interesting.

by icefox 10y ago

Now the question is if there is a exploit in the rom and by crafting your own audio you can make the device much more interesting.

freehunter 10y ago

The easier, hacker way is to intercept the traffic with a proxy: https://medium.com/@edwardbenson/how-i-hacked-amazon-s-5-wifi-button-to-track-baby-data-794214b0bdd8 https://medium.com/@edwardbenson/how-i-hacked-amazon-s-5-wif...

daemonize 10y ago
Similar approach taken for Amazon's Echo Dot exposing parts of setup process and some broken parts: https://medium.com/@dweinstein/amazon-echo-dot-explorations-part-1-5f5ae38ffeab https://medium.com/@dweinstein/amazon-echo-dot-explorations-...
andrewstuart2 10y ago
That only allows reacting to button pushes, though. I'm assuming that by default the mic is only active for initialization by default, but if you can get the microprocessor to execute arbitrary code via a crafted packet, you could presumably access the hardware directly and add more capabilities.
- freehunter 10y ago
  If you have physical access to the hardware, it actually has exposed JTAG under the covers, and it's basically a Particle Photon, so I imagine you'd be able to have a lot of fun. Actually, here's a guide: https://learn.adafruit.com/dash-hacking-bare-metal-stm32-programming/overview https://learn.adafruit.com/dash-hacking-bare-metal-stm32-pro...
simonjgreen 10y ago
Minor thing, but there is no proxy at work here
amelius 10y ago
> Dash buttons are turned off most of the time to preserve the battery inside. They only turn on when you push them. And that means they have to re-connect to your Wifi network every time they are pushed. That’s easy to detect. How do they know for sure? Perhaps they also connect every month for a (status) update or for statistics, but this hacker just missed that. I wouldn't use these buttons to launch any missiles :)
- tedmiston 10y ago
  Curious if anyone knows how the Dash buttons handle when your wifi password has changed since their last successful connect.
  - blacksmith_tb 10y ago
    I believe you have to use the mobile app to go through the Dash set up procedure again if you change your local AP (or get a new one, etc.)

tedmiston 10y ago

What do you mean?