Fail Of The Week: How Not To Do IoT Security

May 30, 2019 by Dan Maloney 68 Comments

There are a lot of bad days at work. Often it’s the last day, especially when it’s unexpected. For the particularly unlucky, the first day on a new job could be a bad day. But the day you find an unknown wireless device attached to the underside of your desk has to rank up there as a bad day, or at least one that raises a lot of serious questions.

As alarming as finding such a device would be, and for as poor as the chain of decisions leading these devices being attached to the workstations of the employees at a mercifully unnamed company, that’s not the story that [Erich Styger] seeks to tell. Rather, this is a lesson in teardown skills – for few among us would not channel the anger of finding something like this is into a constructively destructive teardown – and an investigation into the complete lack of security consideration most IoT devices seem to be fielded with these days.

Most of us would recognize the device as some kind of connected occupancy sensor; the PIR lens being the dead giveaway there. Its location under a single person’s desk makes it pretty clear who’s being monitored.

The teardown revealed that the guts of the sensor included a LoRa module, microcontroller, a humidity/temperature sensor, and oddly for a device apparently designed to stick in one place with magnets, an accelerometer. Gaining access to the inner workings was easy through the UART on the microcontroller, and through the debug connectors and JTAG header on the PCB. Everything was laid out for all to see – no firmware protection, API keys in plain text, and trivially easy to reflash. The potential for low-effort malfeasance by a compromised device designed to live under a desk boggles the mind.

The whole article is worth a read, if only as a lesson in how not to do security on IoT devices. We know that IoT security is hard, but that doesn’t make it optional if you’re deploying out in the big wide world. And there’s probably a lot to learn about properly handling an enterprise rollout too. Spoiler alert: not like this.

Simple, Self-Contained LoRa Repeater In About An Hour

May 2, 2019 by Donald Papp 5 Comments

[Dave Akerman]’s interest in high-altitude projects means he is no stranger to long-range wireless communications, for which LoRa is amazingly useful. LoRa is a method of transmitting at relatively low data rates with low power over long distances.

Despite LoRa’s long range, sometimes the transmissions of a device (like a balloon’s landed payload) cannot be received directly because it is too far away, or hidden behind buildings and geography. In these cases a useful solution is [Dave]’s self-contained LoRa repeater. The repeater hardware is simple, and [Dave] says that if one has the parts on hand, it can be built in about an hour.

The device simply re-transmits any telemetry packets it receives, and all that takes is an Arduino Mini Pro and a small LoRa module. A tiny DC-DC converter, battery, and battery charger rounds out the bill of materials to create a small and self-contained unit that can be raised up on a mast, flown on a kite, or carried by a drone.

The repeater’s frequency and other settings can even be reprogrammed (using a small windows program) for maximum flexibility, making the little device invaluable when going hunting for landed payloads like the one [Dave] used to re-create a famous NASA image using a plastic model and a high-altitude balloon. Check out the details on the GitHub repository for the project and start mashing “add to cart” for parts at your favorite reseller.

Emergency Neighbourhood Communications Courtesy Of HELPER

March 29, 2019 by Lewin Day 23 Comments

For many people, phone and Internet connectivity are omnipresent and always available. It’s possible to upload selfies from a Chinese subway, and search for restaurant reviews in most highway towns, all thanks to modern cellular connectivity. However, in emergencies, we’re not always so lucky. If towers fail or user demand grows too large, things can collapse all too quickly. It’s in these situations that HELPER aims to flourish.

HELPER stands for Heterogeneous Efficient Low Power Radio. It’s a radio system designed to operate in the absence of any infrastructure, creating a pop-up network to serve community needs in disaster areas. Users can share information about available resources, like water, gasoline and food, while emergency workers can coordinate their response and direct aid to those who need it.

It’s a system built around commonly available parts. Raspberry Pis run the back end software and communicate with individuals over WiFi, with LoRa radios handling the longer-range communication from node to node. Combining this communication ability with GPS location and stored map data allows users to more easily find resources and assistance when things go wrong. The journal article is freely available for those wishing to learn more about the project.

It’s a project which aims to keep people safe when conventional networks go down. The key is to remember that once disaster strikes, it’s usually too late to start distributing radio hardware – emergency gear should be in place well before things start to go south. Of course, there’s also the government side of the equation – in the USA, the Emergency Broadcast System is a great example of emergency communications done right. Video after the break.

Continue reading “Emergency Neighbourhood Communications Courtesy Of HELPER” →

Custom LoRa Pager Designed With Care

March 24, 2019 by Lewin Day 13 Comments

LoRa is a useful technology if you need to send data a long way at low power levels. Leveraging this, [5Volt-Junkie] decided to build a small pager named the LoRaNicator.

Those who love a detailed build log will enjoy this. The pager features everything up to and including the kitchen sink. A Cortex M0+ runs the show, flashed with an Arduino compatible bootloader, while a RFM95W module handles the LoRa communications. There’s a pager vibrator and piezo buzzer for notifications, along with a LiPo charger to make keeping the battery topped up easy. There’s even an RTC and soft-power button module.

Even if the LoRa side of things isn’t relevant to your interests, it’s a great example of how to build a useful tool rather than just a proof-of-concept. Things like an easy-to-use interface and simple battery charging go a long way to making something usable in the field. [5Volt-Junkie] even goes so far as to point out that even solder mask matters – if you’re using an infrared oven, your black boards will need a different profile to the usual green PCBs.

All the hard work has paid off, creating an attractive end product that we’d be proud to pack with the rest of our ham gear. LoRa is a useful platform, and as we’ve seen, it can be useful for everything from viticulture to meterology. Video after the break.

Continue reading “Custom LoRa Pager Designed With Care” →

Solar-Powered IoT Sensor Saves Wine Batch From Overheating

November 25, 2018 by Donald Papp 4 Comments

Making wine isn’t just about following a recipe, it’s a chemical process that needs to be monitored and managed for best results. The larger the batch, the more painful it is to have something go wrong. This means that the stakes are high for small vineyards such as the family one [Mare] works with, which have insufficient resources to afford high-end equipment yet have the same needs as larger winemakers. The most useful thing to monitor is the temperature profile of the fermentation process, and [Mare] created an exceptional IoT system to do that using LoRa wireless and solar power.

It’s not enough just to measure temperature of the fermenting liquid; viewing how the temperature changes over time is critical to understanding the process and spotting any trouble. [Mare] originally used a Raspberry Pi, I2C temperature sensor, and a Wi-Fi connection to a database to do the monitoring. This was a success, but it was also overkill. To improve the system, the Raspberry Pi was replaced with a LoRaDunchy board, an STM-based module of [Mare]’s own design which is pin-compatible with the Arduino Nano. It includes a battery charger, power management, and LoRa wireless communication. Adding a solar cell and lithium-polymer battery was all it took to figuratively cut the power cord.

Sensing the temperature of fermentation is done by sealing the temperature sensor into a thin aluminum tube, and lowering that into the vat. There it remains, with the LoRaDunchy board periodically waking up to read the sensor and report the tempurature over LoRa before going back to sleep, all the while sipping power from the battery which in turn gets recharged with solar power.

It’s an elegant system that has already paid off. A 500 litre vat of wine generated an alarm when the temperature rose above 24 Celsius for 10 minutes. An email alert allowed the owner to begin mixing the solution and add ice water to put the brakes on the runaway reaction. The temperature dropped and slow fermentation resumed, thanks to the twin powers of gathering the right data, then doing something meaningful with it.

Vineyards and LoRa have joined forces before, for example in the Vinduino project which aims to enable water-smart farming. If you’re unfamiliar with LoRa in general, the LoRa on the ESP32 project page contains a good primer, and if the antenna on the module shown here looks familiar to you it’s because we recently featured [Mare]’s guide on making DIY LoRa antennas from salvaged wire.

DIY Mini Helical Antennas From Salvaged Co-ax Cable

November 19, 2018 by Donald Papp 24 Comments

[Mare] has a visual guide and simple instructions for making DIY mini helical 868 MHz antennas for LoRa applications. 868 MHz is a license-free band in Europe, and this method yields a perfectly serviceable antenna that’s useful where space is constrained.

A metric 5 mm drill bit makes a convenient core.

The process is simple and well-documented, but as usual with antenna design it requires attention to detail. Wire for the antenna is silver-plated copper, salvaged from the core of RG214U coaxial cable. After straightening, the wire is wound tightly around a 5 mm core. 7 turns are each carefully spaced 2 mm apart. After that, it’s just a matter of measuring and bending the end for soldering to the wireless device in question. [Mare] has used this method for wireless LoRa sensors in space-constrained designs, and it also has the benefit of lowering part costs since it can be made and tested in-house.

Antennas have of course been made from far stranger things than salvaged wire; one of our favorites is this Yagi antenna made from segments of measuring tape.

Vinduino Water-Smart Farming – Now With LoRa!

October 25, 2018 by Roger Cheng 9 Comments

Our five rounds of Hackaday Prize 2018 challenges have just wrapped up, and we’re looking forward to see where the chips fall in the final ranking. While we’re waiting for the winners to be announced at Hackaday Superconference, it’s fun to take a look back at one of our past winners. Watch [Reinier van der Lee] give the latest updates on his Vinduino project (video also embedded after the break) to a Hackaday Los Angeles meetup earlier this year.

Vinduino started with [Reinier]’s desire to better understand what happens to irrigation water under the surface, measuring soil moisture at different depths. This knowledge informs more efficient use of irrigation water, as we’ve previously covered in more detail. What [Reinier] has been focused on is improving usability of the system by networking the sensors wirelessly versus having to walk up and physically attach a reader unit.

His thought started the same as ours – put them on WiFi! But adding WiFi coverage across his entire vineyard was not going to be cost-effective. After experimenting with various communication schemes, he has settled on LoRa. Designed to trade raw bandwidth for long range with low power requirements, it is a perfect match for a network of soil moisture sensors.

In the video [Reinier] gives an overview of LoRa for those who might be unfamiliar. Followed by results of his experiments integrating LoRa functionality into Vinduino, and ending with a call to action for hackers to help grow the LoRa network. It sounds like he’s become quite the champion for the cause! He’s even giving a hands-on workshop at Supercon where you can build your own LoRa connected sensor. (Get tickets here.)

We’re always happy to see open-source hardware projects like Vinduino succeed, transitioning to a product that solve real world problems. We know there are even more promising ideas out there, which is why Hackaday’s sister company Tindie is funding a Project to Product program to help this year’s winners follow in Vinduino’s footsteps. We look forward to sharing more success stories yet to come.

Continue reading “Vinduino Water-Smart Farming – Now With LoRa!” →