Network Hacks

229 Articles

Atmel Announces SmartConnect WiFi Modules

March 1, 2014 by 19 Comments

Atmel SmartConnect

This week we talked with Atmel about their new WiFi solutions targeting Internet of Things applications. Back in 2012, Atmel acquired Ozmo, a company focused on point-to-point WiFi solutions using WiFi Direct. These devices are known as SmartDirect, and have been available for some time.

Atmel has just announced a new product line: SmartConnect. This moves beyond the point-to-point nature of WiFi Direct, and enables connections to standard access points. The SmartConnect series is designed for embedding in low cost devices that need to connect to a network.

The first devices in the SmartConnect line will be modules based on two chips: an Atmel SAMD21 Cortex-M0+ microcontroller and an Ozmo 3000 WiFi System on Chip. There’s also an on-board antenna and RF shielding can. It’s a drop in WiFi module, which is certified by the FCC. You can hook up your microcontroller to this device over SPI, and have a fully certified design that supports WiFi.

There’s two ways to use the module. The first is as an add-on, which is similar to existing modules. A host microcontroller communicates with the module over SPI and utilizes its command set. The second method uses the module as a standalone device, with application code running on the internal SAMD21 microcontroller. Atmel has said that the standalone option will only be available on a case to case basis, but we’re hoping this opens up to everyone. If the Arduino toolchain could target this microcontroller, it could be a great development platform for cheap WiFi devices.

SmartConnect Architectures
The Add-On and Standalone Architectures

At first glance, this module looks very similar to other WiFi modules, including the CC3000 which we’ve discussed in the past. However there are some notable differences. One major feature is the built in support for TLS and HTTPS, which makes it easier to build devices with secure connections. This is critical when deploying devices that are connected over the internet.

Atmel is claiming improvements in power management as well. The module can run straight from a battery at 1.8 V to 3.3 V without external regulation, and has a deep sleep current of 5 nA. Obviously the operating power will be much higher, but this will greatly assist devices that sporadically connect to the internet. They also hinted at the pricing, saying the modules will come close to halving the current price of similar WiFi solutions. SmartConnect is targeting a launch date of June 15, so we hope to learn more this summer.

We’re always excited to see better connectivity solutions. If Atmel comes through with a device allowing for cheaper and more secure WiFi modules, it will be a great part for building Internet of Things devices. With a projected 50 billion IoT devices by 2020, we expect to see a lot of progress in this space from silicon companies trying to grab market share.

40-Node Raspi Cluster

February 17, 2014 by 49 Comments

Multi-node RasPi clusters seem to be a rite of passage these days for hackers working with distributed computing. [Dave’s] 40-node cluster is the latest of the super-Pi creations, and while it’s not the biggest we’ve featured here, it may be the sleekest.

The goal of this project—aside from the obvious desire to test distributed software—was to keep the entire package below the size of a full tower desktop. [Dave’s] design packs the Pi’s in groups of 4 across ten individual cards that easily slide out for access. Each is wired (through beautiful cable management, we must say) to one of the 2 24-port switches at the bottom of the case. The build uses an ATX power supply up top that feeds into individual power for the Pi’s and everything else, including his HD array—5 1TB HD’s, expandable to 12—a wireless router, and a hefty fan assembly.

Perhaps the greatest achievement is the custom acrylic case, which [Dave] lasered out at the Dallas Makerspace (we featured it here last month). Each panel slides off with the press of a button, and the front/back panels provide convenient access to the internal network via some jacks. If you’ve ever been remotely curious about a build like this one, you should cruise over to [Dave’s] page immediately: it’s one of the most meticulously well-documented projects we’ve seen in a long time. Videos after the break.

Continue reading “40-Node Raspi Cluster” →

SkyJack: A Drone To Hack All Drones

December 6, 2013 by 24 Comments

Quadcopters are gradually becoming more affordable and thus more popular; we expect more kids will unwrap a prefab drone this holiday season than any year prior. [Samy’s] got plans for the drone-filled future. He could soon be the proud new owner of his own personal army now that he’s built a drone that assimilates others under his control.

The build uses a Parrot AR.Drone 2.0 to fly around with an attached Raspberry Pi, which uses everybody’s favorite Alfa adapter to poke around in promiscuous mode. If the SkyJack detects an IEEE-registered MAC address assigned to Parrot, aircrack-ng leaps into action sending deauthentication requests to the target drone, then attempts to take over control while the original owner is reconnecting. Any successfully lassoed drone doesn’t just fall out of the sky, though. [Samy] uses node-ar-drone to immediately send new instructions to the slave.

You can find all his code on GitHub, but make sure you see the video below, which gives a thorough overview and a brief demonstration. There are also a few other builds that strap a Raspberry Pi onto a quadcopter worth checking out; they could provide you with the inspiration you need to take to the skies.

Continue reading “SkyJack: A Drone To Hack All Drones” →

CAN Hacking: The Hardware

November 5, 2013 by 35 Comments

So far we have discussed the basics of CAN, in-vehicle networks, and protocols used over CAN. We’re going to wrap up with a discussion of CAN tools, and parts to build your own CAN hardware.

Wiring

Unfortunately, there’s no set standard for CAN connections. The most common connector for high-speed CAN is a DE-9, with CAN high on pin 7 and CAN low on pin 2. However cables will differ, and many are incompatible.

CAN needs to be terminated, preferably by a 120 ohm resistance on either end of the bus. In practice, you can stick a single 120 ohm resistor across the bus to deal with termination.

Tools

A good CAN tool will let you transmit and receive CAN messages, interpret live data using CAN databases, and talk CAN protocols. The tools with this feature set are proprietary and expensive, but some hacker friendly options exist.

GoodThopter

The GoodThopter12

Based on [Travis Goodspeed’s] GoodFET, the GoodThopter by [Q] uses the Microchip MCP2515 CAN to SPI controller to access the bus. The open hardware tool lets you send and receive messages using Python scripts.

CAN Bus Triple

CAN Bus Triple

The CAN Bus Triple device provides an interface to three CAN buses, and can be programmed in an environment similar to Arduino. The open source code provided lets you muck with the second generation Mazda 3. Unfortunately, the hardware does not appear to be open source.

Saleae Logic

Saleae Logic

It’s not open source, but the Saleae Logic is a very handy and cheap tool for looking at CAN buses. It can capture, decode, and display CAN traffic. This is most useful when you’re building your own CAN hardware.

DIY

The Parts

If you want to design your own hardware for CAN, you’ll need two things: a CAN controller, and a CAN transceiver.

The CAN controller generates and interprets CAN messages. There’s many microcontrollers on the market with built-in CAN controllers, such as the Atmel ATmega32M1, Freescale S08D, and the TI Tiva C Series. When using a built-in CAN controller, you’ll have to use an external oscillator, internal oscillators are not sufficiently accurate for high-speed CAN. If you want to add CAN to an existing microcontroller, the MCP2515 is an option. It’s a standalone CAN controller that communicates over SPI.

The transceiver translates signals from the controller to the bus, and from the bus to the transceiver. Different transceivers are needed for high-speed and low-speed CAN networks. The NXP TJA1050 works with high-speed buses, and the ON Semi NCV7356 works with low-speed, single wire buses.

Dev Boards

There’s a ton of development boards out there featuring microcontrollers with a CAN controller. The Arduino Due‘s SAM3 processor has a controller, but there’s no transceiver on the board. You can pick up a CAN bus shield, and the Due CAN Library to get started.

The ChipKIT Max32 is similar to the Due. It has two CAN controllers, but you’ll need to provide external transceivers to actually get on a bus. Fortunately there’s a shield for that. The ChipKIT is officially supported by Ford’s OpenXC Platform, so you can grab their firmware.

That concludes our discussion of CAN Hacking. Hopefully you’re now ready to go out and experiment with the protocol. If you have questions, send them along to our tip line with “CAN Hacking” in the subject, and we’ll compile some answers. If you liked this series and want to suggest a topic for the next set of posts we’d love to hear that as well!

CAN Hacking

CAN Hacking: Protocols

October 29, 2013 by 44 Comments

We’ve gone over the basics of CAN and looked into how CAN databases work. Now we will look at a few protocols that are commonly used over CAN.

In the last article we looked at CAN databases, where each bit of a message is mapped to a specific meaning. For example, bit 1 of a CAN message with ID 0x400 might represent whether the engine is currently running or not.

However, for more complex communications we need to use protocols. These can map many meanings to a single CAN ID by agreeing on a structure for sending and receiving data.

Continue reading “CAN Hacking: Protocols” →

CAN Hacking: The In-vehicle Network

October 22, 2013 by 90 Comments

Last time, we discussed how in-vehicle networks work over CAN. Now we’ll look into the protocol and how it’s used in the automotive industry.

The Bus

On the hardware side, there’s two types of CAN: differential (or high-speed) and single wire. Differential uses two wires and can operate up to 1 Mbps. Single wire runs on a single wire, and at lower speeds, but is cheaper to implement. Differential is used in more critical applications, such as engine control, and single wire is used for less important things, such as HVAC and window control.

Many controllers can connect to the same bus in a multi-master configuration. All messages are broadcast to every controller on the bus.

An oversimplified in-vehicle network
An oversimplified in-vehicle network

Continue reading “CAN Hacking: The In-vehicle Network” →

CAN Hacking: Introductions

October 21, 2013 by 57 Comments

We’re introducing a new series on CAN and automotive hacking. First, we’ll introduce CAN and discuss how in-vehicle networks work.

In 1986, Bosch introduced the Controller Area Network protocol. It was designed specifically for in-vehicle networks between automotive controllers. CAN became a popular option for networking controllers in automotive, industrial, and robotics applications. Starting in 2008, all vehicles sold in the US must use CAN.

Modern vehicles are distributed control systems, with controllers designed to handle specific tasks. For example, a door control module would take care of locks and windows. CAN allows these controllers to communicate. It also allows for external systems to perform diagnostic tasks by connecting to the in-vehicle network.

Some examples of CAN communication in a vehicle include:

  • The engine control module sending the current engine speed to the instrument cluster, where it is displayed on a tachometer.
  • The driver’s door controller sending a message to another door controller to actuate the window.
  • A firmware upgrade for a controller, sent from a diagnostics tool.

CAN is usually used with little or no security, except for the obscurity of the communications. We can use CAN to USB interfaces to listen to the traffic, and then decode it. We can also use these tools to send forged messages, or to perform diagnostic actions. Unfortunately, most of the tools for dealing with CAN are proprietary, and very expensive. The diagnostics protocols are standards, but not open ones. They must be purchased from the International Organization for Standardization.

Next time, we’ll get into the structure of CAN frames, and how traffic is encoded on the bus.

 [Image via Wikipedia]

CAN Hacking