Reverse Engineering The Internet Of Coffee

October 11, 2016 by Jenny List 14 Comments

The public promise of the Internet Of Things from years ago when the first journalists discovered the idea and strove to make it comprehensible to the masses was that your kitchen appliances would be internet-connected and somehow this would make our lives better. Fridges would have screens, we were told, and would magically order more bacon when supplies ran low.

A decade or so later some fridges have screens, but the real boom in IoT applications has not been in such consumer-visible applications. Most of your appliances are still just as unencumbered by connectivity as they were twenty years ago, and that Red Dwarf talking toaster that Lives Only To Toast is still fortunately in the realm of fiction.

The market hasn’t been devoid of IoT kitchen appliances though. One is the Smarter Coffee coffee machine, a network-connected coffeemaker that is controlled from an app. [Simone Margaritelli] bought one, though while he loved the coffee he really wasn’t keen on its not having a console application. He thus set about creating one, starting with reverse engineering its protocol by disassembling the Android version of its app.

What he found was sadly not an implementation of RFC 2324, instead it uses a very simple byte string to issue commands with parameters such as coffee strength. There is no security, and he could even trigger a firmware upgrade. The app requires a registration and login, though this appears to only be used for gathering statistics. His coffee application can thus command all the machine’s capabilities from his terminal, and he can enjoy a drink without reaching for an app.

On the face of it you might think that the machine’s lack of security might not matter as it is on a private network behind a firewall. But it represents yet another example of a worrying trend in IoT devices for completely ignoring security. If someone can reach it, the machine is an open book and the possibility for mischief far exceeds merely pranking its owner with a hundred doppio espressos. We have recently seen the first widely publicised DDoS attack using IoT devices, it’s time manufacturers started taking this threat seriously.

If the prospect of coffee hacks interests you, take a look at our previous coverage.

[via /r/homeautomation]

Self-Driving R/C Car Uses An Intel NUC

October 10, 2016 by Jenny List 21 Comments

Self-driving cars are something we are continually told will be the Next Big Thing. It’s nothing new, we’ve seen several decades of periodic demonstrations of the technology as it has evolved. Now we have real prototype cars on real roads rather than test tracks, and though they are billion-dollar research vehicles from organisations with deep pockets and a long view it is starting to seem that this is a technology we have a real chance of seeing at a consumer level.

A self-driving car may seem as though it is beyond the abilities of a Hackaday reader, but while it might be difficult to produce safe collision avoidance of a full-sized car on public roads it’s certainly not impossible to produce something with a little more modest capabilities. [Jaimyn Mayer] and [Kendrick Tan] have done just that, creating a self-driving R/C car that can follow a complex road pattern without human intervention.

The NUC's-eye view. The green line is a human's steering, the blue line the computed steering. — The NUC’s-eye view. The green line is a human’s steering, the blue line the computed steering.

Unexpectedly they have eschewed the many ARM-based boards as the brains of the unit, instead going for an Intel NUC mini-PC powered by a Core i5 as the brains of the unit. It’s powered by a laptop battery bank, and takes input from a webcam. Direction and throttle can be computed by the NUC and sent to an Arduino which handles the car control. There is also a radio control channel allowing the car to be switched from autonomous to human controlled to emergency stop modes.

They go into detail on the polarizing and neutral density filters they used with their webcam, something that may make interesting reading for anyone interested in machine vision. All their code is open source, and can be found linked from their write-up. Meanwhile the video below the break shows their machine on their test circuit, completing it with varying levels of success.

Continue reading “Self-Driving R/C Car Uses An Intel NUC” →

Hackaday Prize Entry: Raspberry Pi Zero Smart Glass

October 8, 2016 by Jenny List 4 Comments

Some of the more interesting consumer hardware devices of recent years have been smart glasses. Devices like Google Glass or Snapchat Spectacles, eyewear incorporating a display and computing power to deliver information or provide augmented reality on an unobtrusive wearable platform.

Raspberry Pi Zero Smart Glass aims to provide an entry into this world, with image recognition and OCR text recognition in a pair of glasses courtesy of a Raspberry Pi Zero. Unusually though it does not take the display option of other devices of having a mirror or prism in the user’s field of view, instead it replaces the user’s entire field of view with a display and re-connects them to the world through the Raspberry Pi camera.

The display in question is an inexpensive set of “3D Virtual Stereo Digital Video glasses”, of the type that can be found fairly easily on your favourite auction site. They aren’t particularly high-resolution, but the Pi can easily drive them with its composite video output. The electronics and camera are mounted on a headband, in a custom 3D-printed enclosure. All files can be downloaded from the project page.

There is some Python software, but it’s fair to say that there is not a clear demo on the project page showing it working. However this is no reason to disregard this project, because even if its software has yet to achieve its full potential there is value elsewhere. The 3D-printed Raspberry Pi enclosure should be of use to many other similar wearable projects, and we’d almost say it’s worthy of a project all of its own.

Wireless Trivia Game Buzzers Using HopeRF RFM69

October 8, 2016 by Jenny List 2 Comments

TV game shows follow a formula that hasn’t changed much in sixty years. The celebrity presenter, the glamorous assistant, the catch phrases, the gaudy plywood sets, the nervous contestants, and of course the buzzers.

If you want to do a trivia quiz of your own it’s easy enough to dispense with presenter, assistant, set, and catch phrase, but as well as the contestants you’ll still need the buzzers. You can make a mess of wires that the TV technicians of old would have concealed within that set, but in your home or at the pub that could rapidly become inconvenient.

[Larry] solved his trivia game buzzer problems by building a wireless buzzer set. It features 3D printed enclosures containing Adafruit Feather microcontrollers, and instead of wires it uses RFM69 900MHz radio modules. The master unit displays the quickest contestant on an OLED screen, it features a low power standby mode between button presses to save battery power, and care has been taken to add a random timing to button presses to try to avoid collisions.

The buttons themselves started with a 3D printed button working a single tactile switch, but moved to a set of three switches in a triangle after edge presses failed to activate the single switch.

We’ve featured a wired game show buzzer before, but for the complete game show experience how about this countdown timer?

Hackaday Prize Entry: Vendotron

October 7, 2016 by Jenny List 11 Comments

A recurring idea in hackspaces worldwide seems to be that of the vending machine for parts. Need An Arduino, an ESP8266, or a motor controller? No problem, just buy one from the machine!

Most such machines are surplus from the food and drink vending industry, so it’s not unusual to be able to buy an Arduino from a machine emblazoned with the logo of a popular chocolate bar. These machines can, however, be expensive to buy second-hand, and will normally require some work to bring into operation.

A vending machine is not inherently a complex machine nor is it difficult to build when you have the resources of a hackspace behind you. [Mike Machado] is doing just that, building the Vendotron, a carousel vending machine constructed from laser cut plywood and MDF. The whole thing is controlled by an Arduino, with the carousel belt-driven from a stepper motor.

It’s not doing anything commercial vending machines haven’t been doing for years, except maybe having a software interface that allows phone and Bitcoin payments. Where this project scores though is in showing that a vending machine need not be expensive or difficult to build, and broadening access to them for any hackspace that wants one.

We’ve had a few vending machines here before, like this feature on the prototyping process for commercial machines, or even this one that Tweets. Sadly few have a secret button to deliver a free soda though.

Retrotechtacular: Head Start On Tomorrow

October 7, 2016 by Jenny List 64 Comments

In the 1950s and 1960s, the prospects for a future powered by nuclear energy were bright. There had been accidents at nuclear reactors, but they had not penetrated the public consciousness, or had conveniently happened far away. This was the age of “Too cheap to meter“, and The Jetsons, in which a future driven by technologies as yet undreamed of would free mankind from its problems. Names like Three Mile Island, Chernobyl, and Fukushima were unheard of, and it seemed that nuclear reactors would become the miracle power source for the second half of the twentieth century and beyond.

The first generation of nuclear power stations were thus accompanied by extremely optimistic public relations and news coverage. At the opening of the world’s first industrial-scale nuclear power station at Calder Hall, UK in 1956, the [Queen] gave a speech in which she praised it as for the common good of the community, and on the other side of the Atlantic the American nuclear industry commissioned slick public relations films to promote their work. Such a film is the subject of this piece, and though unlike the British they could not muster a monarch, had they but known it at the time they did employ the services of a President.

The Big Rock Point nuclear power plant was completed in 1962 on the shores of Lake Michigan. Its owners, Consumers Power Company, were proud of their new facility, and commissioned a short film about it. The reactor had been supplied by General Electric, and fronting the film was General Electric’s established spokesman and host of their General Electric Theater TV show, the Hollywood actor and future President [Ronald Reagan].

The film below the break starts by explaining nuclear power as a new heat source powering a conventional steam-driven generator, and stresses the safety aspect of reactor control rods. We are then treated to a fascinating view of the assembly of an early-1960s nuclear reactor, starting with the arrival of the pressure vessel and showing the assemblies within it that held the fuel and control rods. Fuel rods are shown at their factory in California, and being loaded onto a truck to be shipped across the continent, seemingly without the massive security that would nowadays accompany such an undertaking. The rods are loaded and the reactor is started, as [Reagan] puts it: “The atom has been put to work, on schedule”.

Continue reading “Retrotechtacular: Head Start On Tomorrow” →

How To Become Part Of An IoT Botnet

October 6, 2016 by Jenny List 28 Comments

We should all be familiar with the so-called Internet Of Things, a proliferation of Internet-connected embedded electronics. The opportunities offered to hardware hackers by these technologies have been immense, but we should also be aware of some of the security issues surrounding them.

Recently, the website of the well-known security researcher [Brian Krebs] suffered a DDoS attack. What made this attack different from previous ones wasn’t its severity, but that it had been directed not from botnets of malware-laced Windows PCs but from compromised IoT devices.

One might ask how it could be possible to take control of such low-end embedded hardware, seeing as it would normally be safely behind a firewall, preloaded with its own firmware, and without a clueless human at its terminal to open malware-laden email attachments. The answer is quite shocking but not entirely surprising, and lies in some astonishingly poor security on the part of the devices themselves. An exposé of one such mechanism comes courtesy of [Brian Butterly], who took an unremarkable IP webcam and documented its security flaws.

The camera he examined exposes two services, a web interface and a Telnet port. While from a security perspective their lack of encryption is a concern this should not pose a significant danger when the device is safely on a private network and behind a suitable firewall. The problem comes from its ability to send its pictures over the Internet, for the owner to be able to check their camera from their phone some kind of outside access is required. Expensive cameras use a cloud-based web service for this task, but the cheap ones like the camera being examined simply open a port to the outside world.

If you are familiar with basic firewall set-up, you’ll be used to the idea that open ports are something that should be under control of the firewall owner; if a port has not been specifically opened then it should remain closed. How then can the camera open a port? The answer lies with UPnP, a protocol enabled by default on most home routers that allows a device to request an open port. In simple terms, the camera has an inherently insecure service which it asks the router to expose to the world, and in many cases the router meekly complies without its owner being any the wiser. We suspect that many of you who have not done so already will now be taking a look at your home router to curtail its UPnP activities.

We covered the [Brian Krebs] DDoS story as it unfolded last week, but we’re sure this is likely to be only the first of many stories in this vein. As manufacturers of appliances struggle to learn that they are no longer in the dumb appliance business they need to start taking their software security very seriously indeed.

Webcam image: Asim18 (Own work) [CC BY-SA 3.0], via Wikimedia Commons.