Meshtastic

13 Articles

This Week In Security: That Time I Caused A 9.5 CVE, IOS Spyware, And The Day The Internet Went Down

June 20, 2025 by 18 Comments

Meshtastic just released an eye-watering 9.5 CVSS CVE, warning about public/private keys being re-used among devices. And I’m the one that wrote the code. Not to mention, I triaged and fixed it. And I’m part of Meshtastic Solutions, the company associated with the project. This is is the story of how we got here, and a bit of perspective.

First things first, what kind of keys are we talking about, and what does Meshtastic use them for? These are X25519 keys, used specifically for encrypting and authenticating Direct Messages (DMs), as well as optionally for authorizing remote administration actions. It is, by the way, this remote administration scenario using a compromised key, that leads to such a high CVSS rating. Before version 2.5 of Meshtastic, the only cryptography in place was simple AES-CTR encryption using shared symmetric keys, still in use for multi-user channels. The problem was that DMs were also encrypted with this channel key, and just sent with the “to” field populated. Anyone with the channel key could read the DM.

I re-worked an old pull request that generated X25519 keys on boot, using the rweather/crypto library. This sentence highlights two separate problems, that both can lead to unintentional key re-use. First, the keys are generated at first boot. I was made painfully aware that this was a weakness, when a user sent an email to the project warning us that he had purchased two devices, and they had matching keys out of the box. When the vendor had manufactured this device, they flashed Meshtastic on one device, let it boot up once, and then use a debugger to copy off a “golden image” of the flash. Then every other device in that particular manufacturing run was flashed with this golden image — containing same private key. sigh

Continue reading “This Week In Security: That Time I Caused A 9.5 CVE, IOS Spyware, And The Day The Internet Went Down” →

Meshtastic Adds Wireless Connectivity To Possum Trap

March 12, 2025 by 10 Comments

Perhaps every gardener to attempt to grow a tomato, lettuce, or bean has had to contend with animals trying to enjoy the food before the gardener themselves can, whether it’s a groundhog, rabbit, mouse, crow, or even iguana. There are numerous ways to discourage these mischievous animals from foraging the garden beds including traps, but these devices have their downsides as well. False alarms can be a problem as well as trapping animals that will be overly aggravated to be inside the trap (like skunks) and while the latter problem can’t easily be solved by technology, the former can with the help of Meshtastic.

[Norman Jester]’s problem was an errant possum, but these nocturnal animals generally come out while humans are asleep, and other nighttime animals like rats can activate the trap and then escape. To help with this, a Meshtastic node was added to the San Diego mesh using a 3.5mm audio jack as a detector. When the trap is activated, the closing door yanks a plug out of the jack, alerting the node that the trap has been closed. If it’s a false alarm the trap can be easily and quickly reset, and if a possum has found its way in then it can be transported to a more suitable home the next day.

It’s worth noting that American possums (distinct from the Australian animals of the same name) are an often-misunderstood animal that generally do more good than harm. They help to control Lyme disease, eat a lot of waste that other animals won’t, don’t spread rabies, and don’t cause nearly as much disruption to human life as other animals like feral cats or raccoons. But if one is upsetting a garden or another type of animal is causing a disturbance, this Meshtastic solution does help solve some of the problems with live traps. For smaller animals, though, take a look at this Arudino-powered trap instead.

Thanks to [Dadsrcworkbench] for the tip!

Continue reading “Meshtastic Adds Wireless Connectivity To Possum Trap” →

Get Into Meshtastic On The Cheap With This Tiny Node Kit

March 8, 2025 by 15 Comments

There’s been a lot of buzz about Meshtastic lately, and with good reason. The low-power LoRa-based network has a ton of interesting use cases, and as with any mesh network, the more nodes there are, the better it works for everyone. That’s why we’re excited by this super-affordable Meshtastic kit that lets you get a node on the air for about ten bucks.

The diminutive kit, which consists of a microcontroller and a LoRa module, has actually been available from the usual outlets for a while. But [concretedog] has been deep in the Meshtastic weeds lately, and decided to review its pros and cons. Setup starts with flashing Meshtastic to the XIAO ESP32-S3 microcontroller and connecting the included BLE antenna. After that, the Wio-SX1262 LoRa module is snapped to the microcontroller board via surface-mount connectors, and a separate LoRa antenna is connected. Flash the firmware (this combo is supported by the official web flasher), and you’re good to go.

What do you do with your new node? That’s largely up to you, of course. Most Meshtastic users seem content to send encrypted text messages back and forth, but as our own [Jonathan Bennett] notes, a Meshtastic network could be extremely useful for emergency preparedness. Build a few of these nodes, slap them in a 3D printed box, distribute them to willing neighbors, and suddenly you’ve got a way to keep connected in an emergency, no license required.

What The Well-Dressed Radio Hacker Is Wearing This Season

February 13, 2025 by 7 Comments

We’ve seen a lot of interest in Meshtastic, the license-free mesh network for small amounts of data over the airwaves. [Ham Radio Rookie] was disappointed with his Meshtastic node’s small and inefficient antennas. So he decided to make what we suspect is the world’s first Meshtastic necktie.

We assume the power is low enough that having it across your thorax is probably not terrible. Probably. The tie is a product of a Cricut, Faraday cloth, and tiny hardware (the Xiao ESP32S3 and the WIO SX1262 board). The biggest problem was the RF connector, which needed something smaller than the normal BNC connector.

Continue reading “What The Well-Dressed Radio Hacker Is Wearing This Season” →

The Vecdec Cyberdeck Is More Than A Pretty Case

November 19, 2024 by 30 Comments

A common criticism we hear of cyberdecks is that functionality too often takes a backseat to aesthetics — in other words, they might look awesome, but they aren’t the kind of thing you’re likely to use a daily driver. It’s not an assessment that we necessarily disagree with, though we also don’t hold it against anyone if they’re more interested in honing their build’s retro-futuristic looks than its computational potential.

That said, when a build comes along that manages to strike a balance between style and function, we certainly take notice. The vecdec, built by [svenscore] is a perfect example. We actually came across this one in the Desert of the Real, also known as the outskirts of Philadelphia, while we stalked the chillout room at JawnCon 0x1. When everyone else in the room is using a gleaming MacBook or a beat-up ThinkPad, its wildly unconventional design certainly grabs your attention. But spend a bit of time checking the hardware out and chatting with its creator, and you realize it’s not just some cyberpunk prop.

Continue reading “The Vecdec Cyberdeck Is More Than A Pretty Case” →

Decoding Meshtastic With GNU Radio

June 26, 2024 by 21 Comments

Meshtastic is a way to build mesh networks using LoRa that is independent of cell towers, hot spots or traditional repeaters. It stands to reason that with an SDR and GNU Radio, you could send and receive Meshtastic messages. That’s exactly what [Josh Conway] built, and you can see a video about the project, Meshtastic_SDR, below. The video is from [cemaxecuter], who puts the library through its paces.

For hardware, the video uses a Canary I as well as the WarDragon software-defined radio kit which is an Airspy R2 and a mini PC running Dragon OS — a Linux distribution aimed at SDR work —  in a rugged case. GNU Radio, of course, uses flows which are really just Python modules strung together with a GUI.

Continue reading “Decoding Meshtastic With GNU Radio” →