Weather Station Needs Almost No Batteries

November 13, 2017 by Bryan Cockfield 38 Comments

While the ESP8266 has made its way into virtually every situation where a low-cost WiFi solution is needed, it’s not known as being a low-power solution due to the amount of energy it takes to run WiFi. [Alex] took this design constraint as more of a challenge though, and with the help of an ATtiny microcontroller was able to develop a weather station using an ESP8266 that only needs new batteries every 2-4 years.

While the ESP8266 module consumes a bit of power, the ATtiny excels in low-power mode. To take advantage of this, [Alex] designed the weather station using the ATtiny to gather data every two minutes, store the data in a buffer, and upload all of it in bursts every hour using the ESP8266. This means that the power-hungry WiFi chip can stay off most of the time, drastically limiting the power demands of the station. [Alex] mostly details the setup of the ATtiny and the ESP8266 on his project page, so this could be applied anywhere that low power and network connectivity are required.

As for the weather reporting capabilities, the station is equipped to measure temperature, light, and humidity. Presumably more could be added but this might increase the power demands for the weather station as a whole. Still, changing batteries once a year instead of once every two years might be a worthwhile trade-off for anyone else attempting such an ambitious project. Other additions to the weather station that we’ve seen before might include a low-power display, too.

Oh Great, WPA2 Is Broken

October 16, 2017 by Brian Benchoff 131 Comments

WPA2, the standard security for Wi-Fi networks these days, has been cracked due to a flaw in the protocol. Implications stemming from this crack range from decrypting Wi-Fi, hijacking connections, and injecting content. It’s fair to say, WPA2 is now Considered Harmful. The paper is available here (PDF).

This is a proof-of-concept exploit, and like all headline-making network security stories, it has a name. It’s called KRACK, for Key Reinstallation Attack. The key insight to this exploit is a vulnerability in the handshaking between routers and devices to establish a secure connection.

This is not the first time the researchers behind this exploit have found holes in WPA2. In a paper published by the KRACK researchers at the USENIX Symposium last August (PDF), they showed that the Random Number Generator used in 802.11 is flawed, ill-defined, and insecure. The researchers have also spoken at 33c3 on predicting WPA2 Group Keys.

The practical consequences of a poor definition and implementation of an RNG can be found in consumer hardware. The researchers found that in MediaTek-based routers, the only source of randomness is the current time. Meanwhile Broadcom-based routers do not use the RNG proposed by the 802.11 spec, but instead take the MD5 of the current time in microseconds. The researchers do not mention if the current time is a secret.

So what do we do now?

This has happened before. In 2001, WEP, the Wi-Fi security protocol many security-ignorant people are still running, was cracked in much the same was as KRACK. This quickly led to the development of Aircrack, and in 2003, the Wi-Fi Alliance rolled out WPA and WPA2. Sure, you can still select a deprecated security protocol for your router, but the problem of WEP hacking is as solved as it’s ever going to be.

The early 2000s were a different time when it came to wireless networks, though here in 2017 Wi-Fi permeates every cubic inch of our lives. Everything and everyone has Wi-Fi now. This is going to be a bit bigger than cracking WEP, but it remains possible to patch devices to ensure that this exploit is rendered useless. Install those security updates, people! Of course there will still be millions of unpatched devices in a year’s time, and for those routers, IoT baubles, and other wireless devices, turning on WPA2 will be akin to having no security at all.

That said, this isn’t a world-ending Armageddon in the way the botnet of webcams was. You will only be vulnerable if an attacker is within range of your router, and you will still be secure if you’re accessing secure websites. However, turning off Wi-Fi on your phone, relying on mobile data, not ignoring HTTPS cert warnings, and plugging into an Ethernet port might not be a bad idea.

7-Segment Digits Slide Stylishly On This OLED Clock

October 2, 2017 by Donald Papp 19 Comments

Over at Sparkfun, [Alex] shared an OLED clock project that’s currently in progress but has a couple interesting twists. The first is the use of a small OLED screen for each digit, to which [Alex] added a stylistic touch. Digits transition by having segments slide vertically in a smooth animated motion. It’s an attractive effect, and the code is available on his github repository for anyone who wants to try it out.

[Alex] also found that by using an ESP32 microcontroller and synchronizing the clock via NTP over WiFi, the added cost of implementing a real-time clock in hardware becomes unnecessary. Without an RTC, time would drift by a few seconds every day and require a reset. At the moment the clock requires the SSID and password to be hardcoded, but [Alex] would prefer to allow this to be configured via a web page and could use some help. If you have implemented a web server on the ESP32, [Alex] would like to know how you handled multiple pages. “I’ve been scratching my head throughout the build on how to get this done,” he writes. “With the ESP8266, there’s on(const String &uri, handler function), but that seems to have been removed on the ESP32.” If you can point [Alex] in the right direction, be sure to pipe up.

OLED displays and clocks often go together, as we have seen with projects like the DIY OLED Smart Watch, but it’s nice to see someone using the OLED’s strengths to add some visual flair to an otherwise plain display.

Simultaneous AP & Client On The Pi Zero W

September 29, 2017 by Lewin Day 34 Comments

The Raspberry Pi Zero W is a great platform for IoT projects, with a smattering of GPIO and onboard WiFi. However, security is an important consideration when it comes to the Internet of Things and it can be beneficial to keep your IoT devices on a separate network for safety’s sake. [Albert] wanted to do this all on board the Pi Zero W, and figured out how to get it acting as an access point and a client all at the same time.

[Albert] starts off with a fresh install of Raspbian Stretch, and sets the Pi up in OTG mode. This allows access to the Pi over a USB serial terminal. This is great for productivity when working on headless networking projects, as it can be frustrating trying to work with an SSH session that keeps dropping out when you change settings.

After creating a second named device (ap0) to go along with the one created automatically by the kernal (wlan0), DNSmasq is installed to act as a DHCP server for the AP. Hostapd is then installed to control the AP settings. Following this, like anything in Linux, a flurry of configuration files are edited to get everything humming along and starting up automatically after a reboot. For some reason, things don’t start up smoothly, so [Albert] has a cron job that fires 30 seconds after bootup and toggles the interfaces off and on again, and that’s done the trick.

It’s a useful hack, as it allows the Pi Zero to act as a hub for IoT devices, while also creating a bridge between them and the internet. Traffic can be managed to stop random internet users flicking your lights on and off and overspeeding your dishwasher.

We’ve seen the Pi Zero used for just about everything under the sun so far. If you’re just starting your own IoT build, perhaps you’d like to use the Pi Zero as a streaming camera?

DIY Wireless Sprinkler System? Don’t Mind If I Do.

September 5, 2017 by James Hobson 13 Comments

What to do once you have a sprinkler system installed on your property: buy a sprinkler control system or make your own? The latter, obviously.

[danaman] was determined to hack together a cheap, IoT-enabled system but it wasn’t easy — taking the better part of a year to get working. Instead of starting right from scratch, he used the open-source Sustainable Irrigation Platform(SIP) control software — a Python sprinkler scheduler with some features [danman] was looking for(eg: it won’t activate if there’s rain in the forecast). Since he wasn’t running it with a Raspberry Pi as recommended, [danman] wrote a Python plugin that runs on his home server as a daemon which listens to TCP port 20000 for connections and then updates the relevant relays. Ok, software done; on to the relay controller box!

Continue reading “DIY Wireless Sprinkler System? Don’t Mind If I Do.” →

WiFi Deauthentication VS WiFi Jamming: What Is The Difference?

August 13, 2017 by Jack Laidlaw 24 Comments

Terminology is something that gets us all mixed up at some point. [Seytonic] does a great job of explaining the difference between WiFi jammers and deauthenticators in the video embedded below. A lot of you will already know the difference however it is useful to point out the difference since so many people call deauth devices “WiFi Jammers”.

In their YouTube video they go on to explain that jammers basically throw out a load of noise on all WiFi channels making the frequencies unusable in a given distance from the jammer. Jammers are also normally quite expensive, mostly illegal, and thus hard to find unless of course you build your own.

WiFi deauthentication on the other hand works in a very different way. WiFi sends unencrypted packets of data called management frames. Because these are unencrypted, even if the network is using WPA2, malicious parties can send deauthentication commands which boot users off of an access point. There is hope though with 802.11w which encrypts management frames. It’s been around for a while however manufacturers don’t seem bothered and don’t implement it, even though it would improve the security of a WiFi device from these types of attacks.

Continue reading “WiFi Deauthentication VS WiFi Jamming: What Is The Difference?” →

Broadpwn – All Your Mobiles Are Belong To Us

July 29, 2017 by Pedro Umbelino 50 Comments

Researchers from Exodus Intel recently published details on a flaw that exists on several Broadcom WiFi chipsets. It’s estimated to affect nearly 1 Billion devices, from Android to iPhone. Just to name a few in the top list:

Samsung Galaxy from S3 through S8, inclusive
All Samsung Notes3. Nexus 5, 6, 6X and 6P
All iPhones after iPhone 5

So how did this happen? And how does a bug affect so many different devices?

A smart phone nowadays is a very complicated mesh of interconnected chips. Besides the main processor, there are several other secondary processors handling specialized tasks which would otherwise clog up the main CPU. One of those is the WiFi chipset, which is responsible for WiFi radio communications — handling the PHY, MAC and MLME layers. When all the processing is complete, the radio chipset hands data packets over the kernel driver, which runs on the main CPU. This means that the radio chipset itself has to have some considerable data processing power to handle all this work. Alas, with great power comes great responsibility.

Continue reading “Broadpwn – All Your Mobiles Are Belong To Us” →