The Internet of Things will revolutionize everything! Manufacturing? Dog walking? Coffee bean refilling? Car driving? Food eating? Put a sensor in it! The marketing makes it pretty clear that there’s no part of our lives which isn’t enhanced with The Internet of Things. Why? Because with a simple sensor and a symphony of corporate hand waving about machine learning an iPhone-style revolution is just around the corner! Enter: Amazon Dash, circa 2014.
The first product in the Dash family was actually a barcode scanning wand which was freely given to Amazon Fresh customers and designed to hang in the kitchen or magnet to the fridge. When the Fresh customer ran out of milk they could scan the carton as it was being thrown away to add it to their cart for reorder. I suspect these devices were fairly expensive, and somewhat too complex to be as frequently used as Amazon wanted (thus the extremely limited launch). Amazon’s goal here was to allow potential customers to order with an absolute minimum of friction so they can buy as much as possible. Remember the “Buy now with 1-Click” button?
That original Dash Wand was eventually upgraded to include a push button activated Alexa (barcode scanner and fridge magnet intact) and is generally available. But Amazon had pinned its hopes on a new beau. Mid 2015 Amazon introduced the Dash Replenishment Service along with a product to be it’s exemplar – the Dash Button. The Dash Button was to be the 1-Click button of the physical world. The barcode-scanning Wands require the user to remember the Wand was nearby, find a barcode, scan it, then remember to go to their cart and order the product. Too many steps, too many places to get off Mr. Bezos’ Wild Ride of Commerce. The Dash Buttons were simple! Press the button, get the labeled product shipped to a preconfigured address. Each button was purchased (for $5, with a $5 coupon) with a particular brand affinity, then configured online to purchase a specific product when pressed. In the marketing materials, happy families put them on washing machines to buy Tide, or in a kitchen cabinet to buy paper towels. Pretty clever, it really is a Buy now with 1-Click button for the physical world.
There were two versions of the Dash button. Both have the same user interface and work in fundamentally the same way. They have a single button (the software can recognize a few click patterns), a single RGB LED (‘natch), and a microphone (no, it didn’t listen to you, but we’ll come back to this). They also had a WiFi radio. Version two (silently released in 2016) added Bluetooth and completely changed the electrical innards, though to no user facing effect.
In February 2019, Amazon stopped selling the Dash Buttons.
This is Hackaday, not Business Insider
Right, why are we eulogizing a corporate strategy on Hackaday? The Dash Buttons were a clever hack! In a post-ESP8266 world, hardware like the Dash Button is the standard home automation starter project. But in 2015 when the Buttons were released the ESP was just starting to make waves. Up until that point, WiFi meant an unusual device like an Electric Imp or expensive ICs with an image of Texas on them. The market for low cost internet connected devices was very different, and much more expensive, back then.
A device like the Dash button probably doesn’t make sense for Amazon to build if it costs more than a couple dollars to make, so a few tricks were played to keep costs down without compromising user experience.
So what’s a hacker to do? Bluetooth works pretty well, but requires another radio. The previously mentioned Electric Imp uses a photosensor that you press against your phone screen while it spastically flashes in a pattern encoding the credentials. Devices could be preprogrammed, like Amazon does with a new Kindle and the purchaser’s Amazon account credentials, but this is an elaborate factory process and you still need a fallback for when networks change. Instead of these workarounds, Amazon chose something I’ve only ever heard as a joke; acoustic pairing.
What about the rest of the enclosure? It looks just about as simple as can be. There are screws to hold the PCBA to the top of the case, but everything else is glued or ultrasonically welded together. The shape of each plastic components also seems to be quite friendly for injection molding, with no overhangs and a curved geometry very amenable to hefty draft angles. All in all the device appears to be fast and easy (read: cheap) to manufacture, which isn’t a huge surprise.
Hackability
What hacks can you perform on a Dash Button? If people are going to begin throwing away these astonishingly cheap devices, can we give them another life?
Perhaps the first Dash hacks repurposed the devices without software or hardware hackery at all. When a Button is between presses, it is turned off to save power. Long term, even the occasional spikes to keep up with WiFi connection intervals would represent significant power consumption: the Dash Buttons are designed to last for years of normal usage, so they don’t stay connected. When you press the button, the device wakes up, toggles its LED to indicate liveliness, connects to WiFi, hits Amazon’s API, then drops back off the network and turns the lights out. When they connect to your local network they necessarily go through a few setup steps including broadcasting an ARP probe to make sure no one else is sharing the same MAC address.
Enterprising hackers realized that if you can watch traffic on your LAN then you can see these ARP probes, which include the device’s unique MAC address. And because of the very specific lifecycle of a Dash Button, if you can see the ARP probe then you can imply the device just woke up, which in turn means the button was just pressed. At that point doing something with that information is just plumbing. The first mention of this method that I’ve found is from [Ted] in this post. Even if Amazon’s back end eventually goes down there’s no reason this would stop working.
Broadcom Cypress BCM943362WCD4 module from the WICED family which is just an STM32F205 glued to a radio, for which a devkit is available. Version 2 seems to be an Atmel Microchip ATSAMG55 and an Atmel Microchip ATWINC1500B, with a Cypress CYBL10563-68FNXI Bluetooth radio for good measure. Interesting commentary about market consolidation aside, these are well documented ARM CPUs which are freely available.
And yet, despite availability of both demonstration hardware and Dash Buttons, no one seems to have gotten very far. It’s easy to find great tutorials on reflashing the device and blinking the LED or listening for button presses, but every tutorial I’ve found ends with the frustrating cliffhanger “from here, just figure out WiFi.” So yes they can be reprogrammed into weird little development boards, but we have yet to see someone fully control the device so we can access all the juicy functionality contained within.
What’s Next?
Before wrapping up, lets take a moment to alternatively commend and condemn Amazon here. “Small” hardware projects like the Dash Button and Wand are my favorite kind of corporate experimentation. I’m always excited when a company tries to make an usual hardware product. (The Dash Wand has an honest to goodness barcode scanner!!) This is much preferable to killing these sorts of ideas before they make it out of the lab.
On the other hand, the Dash Buttons are pretty wasteful. It’s fine that they are designed to have a limited lifespan but no markings are going to keep them from going into household garbage when they stop working. What else should Amazon expect users to do? The device obviously has a battery inside but with no clear reminders like a battery door, it’s not going to be obvious to users in the final moments of the device’s life that it should be sent for battery disposal. The use of a typical household battery was quite clever, but the right follow up would have been inclusion of some way to remove it, allowing for unlimited product life and more considerate disposal.
On a more positive note, we’re hoping it’s about to get very easy to pick up huge sacks of Dash Buttons! As they stop working we can break the e-waste cycle by collecting them and providing a new purpose.
Once we start seeing these show up in project drawers there are two paths of exploration worth following. One is finding a set of battery tabs which fit nicely on the existing PCBA so the batteries can be replaced, along with new housings amenable to printing with which to contain it all. At that point the Dash Button can escape the shackles of their finite design lifetimes and run as long as we want them too.
The other course of investigation is obvious: finally get the WiFi working! Though in my experience Broadcom’s WICED branded WiFi parts can get pretty complex, the WINC1500 doesn’t seem to be very exotic. As Adafruit noted in 2016 this module was actually used in the Arduino MKR1000 and WiFi Shield 101, as well as a series of Adafruit boards. So can this be figured out? We’d hope so! As always, if you find new life for an Amazon Dash Button with new enclosures, clever firmware, or anything else we’d love to hear about it!
i really hope someone figures out to configure wifi on dash button once amazon sunsets it’s servers and removes pairing capabilities from it’s app. they make great IoT buttons and cheap sensors. Lasts years on single battery (replaceable in v2) and small enough to put in different places in wifi range. I have been using one for years as my mailbox open sensor.
Only trouble is if they get reset (due to long press) they lose wifi pairing and in absence of amazon app/servers it will be difficult to pair again with wifi.
In absence of Amazon Servers, the V2 can be ‘re-enrolled’ to wifi if the key is held down. It’s not really reset, it only loses wifi setup. Connect your phone to the AP the v2 provides during setup, and open the following URL to re-pair WiFi:
http://192.168.0.1/?amzn_ssid=SSID&amzn_pw=PASSWORD
Will try it tonight, but I thought with V2 they removed configuration through URL. If it works then it will be awesome. :-)
just came across https://www.reddit.com/r/DashHacking/comments/50swxo/current_state_of_affairs_concerning_jk29lp_in/ which author claims that after wifi is configured, button will try to reach to mothership and if it can’t (checks SSL cert too so difficult to fake) then it will ‘forget’ the settings.
Unfortunately this turned out to be true. Just had one of the buttons which reset after several months of working. When following the instructions.. (grabbing home page, then with json, and then random id url, and then finally setting the SSID and password), it connects once and then still doesn’t save the settings. (presumably since it couldn’t connect to mothership).
I have 2 that I never activated before and am not able to activate now that the amazon service has sunset.
I think one of Donald A. Norman’s books covered when computers are embedded in everything.
As cool as the Dash Buttons are, isn’t the “simple internet button” a relatively solved issue now? Couldn’t you get an ESP8266 and build a Dash Button equivalent for less cost and time? I have a stack of the Dash Buttons, but kinda thing they’re just mostly trash now?
Yeah, when I first read of the Dash buttons becoming unavailable, I heard something along those lines: basically, the opinion was that the ease and cost of devices like the ESP8266 effectively stalled any further work on the Dash hacking because of that disparity in effort needed (one thing that had to be bodged versus something designed to be customised and put into your own solution).
I think if you already have them (or can get them for zero-cost) then maybe there’s still something in having Dash buttons but given that they’re still not fully unlocked (meaning limited use at present), the ESP devices make so more sense.
what i like about dash buttons is, they can be used as sensors (just attach reed switch/tilt sensors) to button connectors. they use single AA battery (replaceable in v2, esp8266 requires more to run). Excellent power management (lasts years where as esp8266 will probably last few days). For simple operations they work great.
esp8266 provide more flexibility in but at cost of power requirements and packaging.
Does the processor and radio really run on 1,5V or is there a DC/DC converter?
It was also unhelpful to the “hacker” cause that Amazon anticipated demand from “Makers” and specifically marketed an “IoT” variant of the Dash button. In return for your un-subsidized $20 purchase, you got identical hardware with a different, but fully documented/supported software load.
It would be nice if they made the IoT firmware freely available for the rest of the Dash Button fleet, now that they’ve sunset the official support.
Part of the point is that you have a stack of what is now electronic waste. If they can be used, then it gives them a purpose other than waste.
how about you scan the barcode with your phone and fill up your e-basket? even so if i’m in a supermarket and i scan one code the app can tell me the amazon’s price for it, so i can decide to but it in that store or wait for the delivery drone from amazon
The physical 1-Click buy button is a bad idea. Just imagine that during a party one of your drunk friends goes to bathroom, sees one of those buttons on the washing machine, and starts pushing it. Next day Amazon truck comes by and unloads on your front porch enough detergent to last for next five years…
There were several things that stopped this from happening. Like multiple button presses just register one request to purchase, unless enough time had passed. And if I remember right Amazon would still send a confirmation email that had a link to cancel the order. So iff you did miss the email it would just send one not five years worth.
This is correct. By design, Amazon ignored button-pushes from a Dash button, while a previous order placed from the Dash button was still in-flight.
Mistaking the washing machine for the toilet,
Might want to limit your friends alcohol intake…
I actually had the Charmin button in my bathroom during a party. I had recently ordered a case. Two days later I had another case. That lasted me awhile. I also moved that button . Thankfully multiple presses don’t do anything until after a delivery.
reminds of an incident many years ago when we were switching an SYS/38 to an AS/400 and had the old box in the elevator bay waiting to be disconnected, boxed and shipped. why it was still connected to live power is beyond me. Well, we also used that bay to get to the other side office which was just easier.
Welp the new guy, who walked by there daily just couldn’t ignore the big power button, and decides to press it. umm, our electrical couldn’t handle two servers running and everything just went down……..
truly surprising thing is he wasn’t fired…..
(Had similar story at job after that where the electrician cut the wrong cable…….)
Did that machines consume such gigantic amounts of power or was this a tiny UPS system, which got overloaded?
“broadcasting an ARP probe to make sure no one else is sharing the same MAC address.”
Did you mean “same IP address”?
Yeah I wondered this. If it already had a unique Mac why would it need to probe it?
He probably did mean IP address, but don’t make the mistake of thinking all devices have unique MAC addresses. Usually they do, but sometimes they don’t.
I have actually went with Electric Imp at that time… Quite interesting, I must say, especially then. It still controls my garage door, but then only because I did not feel like replacing it with ESP.
I did some work on the V2 recently as I bought a stack from eBay cheaply. With the services shutting down September 1st, I think there are literally only days left to program your dash buttons. A few things I’ve learned so far:
– A brand new V2 button needs to talk to Amazon servers to get a unique ‘secret’. After this secret is downloaded to the button, all connections to Amazon need to be rerouted in order to stop the button from decommissioning after the next push
– An enrolled button will sometimes stop working after a couple of tries to connect to the Amazon infrastructure. It will jump to ‘pair/setup’-mode, and you need to connect to Wifi using the app again
– If you block Amazon’s servers, the button will attempt to connect multiple times, leaving the mcu and radio on longer than necessary. A better solution is to route Amazon’s servers to another SSL capable server. The button will figure out there’s a problem with SSL and will shut down a whole lot faster. In this mode, the button will not revert to setup after a while
– An enrolled button can be paired to a different wifi network by entering setup mode (long push) and accessing this URL through it’s wifi accesspoint in that mode: http://192.168.0.1/?amzn_ssid=SSID&amzn_pw=PASSWORD
The button will immediately shut down after accessing this URL, and will try to connect to this URL the next time you press the button
– As mentioned in the article, the v2 uses a fairly standard Atmel ARM and a custom Wifi CPU. There’s more on the board though, such as a flash chip and a bluetooth unit. The Atmel CPU programming lines are broken out to test points and a header; however; the chip is locked down and needs a full erase to clear the fuses. This can be done by pulling pin 3 high. Pin 3 is pulled to ground on the v2 board, both with a via close to the pin, and a connection to the thermal pad under the mcu as well. The chip itself is glued down with some sort of compound, which can be difficult to remove. The atmel mcu can be removed with hot air, but due to the proximity of many many passives and other small ic’s, there is a significant risk of ruining the board
– The board is a 4-layer job. Due to the many traces on the layers in between, drilling the pad out from underneath pin 3 on the Atmel isn’t gonna work.
– The relevant pins have been reverse engineered by the same chap from the 33c3 video, and can be found on a German forum. https://www.mikrocontroller.net/topic/405371
I sure hope someone figures out how to reprogram these things!
Would be nice to also do some wireshark captures / traces to determine which servers the button communicates with. A few people online mentioned that the hardcoded dns address is Google’s (8.8.8.8) and a few others have mentioned host names / servers it connects to include… dash-button-na.amazon.com & dash-button-jp.amazon.com amongst others. So far it is sept 2nd and all of my buttons are still working and the servers are still up. Not sure what it means but fingers crossed that nothing really changes.
You could make a heat shield out of Al foil (1-2 layers) around the Atmel CPU to protect the passives when you want to remove the CPU with hot air. I have seen this done by phone repair guys to protect the delicate boards.
Hi, I have 5 dash buttons that I use in my home automation application (created with NodeJs) managed through a raspberry. The buttons were exploited through the usual hack that intercepts the ARP probe request. Yesterday I made the mistake of deleting all 5 devices from the Amazon account thinking naively that they would continue to work … instead at the first press of the button they connected to the amazon server that sent them the “death packet”… Now if I try to reconfigure them by long press and then enter the url setup mode http://192.168.0.1/?amzn_ssid=SSID&amzn_pw= PASSWORD, the button turns off but when I press again the button it doesn’t seem to reconnect to the wifi (which is the same wifi network I used before, I don’t know if it is necessary to connect to a different SSID) showing the fixed blue led and blinking red after a while.
In any case if it succeeds in reconnecting it will come back again on the amazon server to take back the package of death. I managed to save two dash buttons avoiding that they could connect to the internet (disconnected from the router connection), so if it were possible to block the contacted domain on the router I would avoid that these two buttons “fry”. But beyond this I would like to be able to recover even the 3 devices already locked … Does anyone have any suggestions?
I have two that I never enrolled so I am in the same boat as you
Does anyone actually know of a “simple IoT” button that just pings a URL or something simple that I don’t have to jump through hoops to just get it to work? I would kill for something like that.
A tiny ardunio or atmega chip can do it quite simply, the challenge is keeping it powered for years without intervention. I too am looking for an easy solution there – any ideas anyone?
Is there a replacement that will work with other IoT api and such?
Since Amazon is going to decommission the button system, is there any chance we can convince them to release a unlocked firmware so people can play around?
Everyone contact Amazon and ask them to release the information and source code for both dash button versions after they shut down their service. Tell them it’s the “green” thing to do.
I have generation 2 dash buttons and found it fairly simple to open the case to change the battery. I posted a video of the method I used here https://youtu.be/CouDVNjpuXc
It’s not as cheap as the “good old days,” but if you have an application using a dash button and don’t want to give it up (as I do), there is a alternative. I purchased an “AWS IoT Enterprise” button. (These are still available from Amazon: https://www.amazon.com/All-New-AWS-IoT-Enterprise-Button/dp/B075FPHHGG/) My understanding is that using it the “correct” way requires a monthly fee, but you can play the same trick that was used with the free buttons: Go through the setup process just far enough to get it connected to the WiFi network. Now, when I press the button, it connects to the network and generates an ARP request, so I can use it with my system just like one o fhe “old” buttons.
You’d think someone from the Amazon development team would feel a little guilt over the e-waste that has been created and leak some code to make these things hackable instead of toxic waste.