[TriEmbed] Amazon Dash button simple detection

Sun Jul 24 10:56:53 CDT 2016

My wifi router is doing all the work...

- Added new AP "dash"
- Route "dash" AP to Internet
- Setup Dash buttons. stopping at the product selection screen.  (Note this
can be skipped if you manually configure the button)
- Cut AP "dash" from Internet
- Changed DHCP logging to include "Request" and ARP
- Scan log from Python for new events
- Do whatever I please.  Push Dash mounted as doorbell to send sounds to TV
and music players plus send SMS that someone is at the door... turn on
porch light and take a picture... electrify porch rails with the cattle
tamer...

Advantages:

- The AP is always on and the Dash are connecting to it anyways
- Separate SSID keeps them off my data SSIDs plus the entire AP
configuration of the Dash is done in the open where anyone with a sniffer
can capture it.  The Dash SSID is not routers and therefore goes nowhere if
someone gets into it.
- Script doesn't have to deal with all the usually network traffic
- Dash buttons can't call home.
- I can use them once to get my $5 credit.  The Energizer button paid me
$0.17 to take a 16 pack of AAs off Amazon's hands after the cost of the AA
and button.
- It was so simple!

Note that you can also telnet to talk with the button and configure it
outside of the Amazon app.  V1 buttons have a configuration screen via
HTML.  V2 buttons require special JSON requests (not complex) to pull the
AP list and then set the base configuration.  Using this method you never
have to talk to Amazon's servers.  The major advantage to this is you
aren't sharing your SSID and Key with Amazon.

Note if anyone is looking for a button to play with, I'll have a few at the
next meeting.

Mike

On Sat, Jul 23, 2016 at 11:58 PM, Pete Soper via TriEmbed <
triembed at triembed.org> wrote:

> To fill in a few blanks, the scapy-dependent Dash detector involving
> diaper logging that a ton of other implementations copy (including the one
> Rod pointed to) is here
> <https://medium.com/@edwardbenson/how-i-hacked-amazon-s-5-wifi-button-to-track-baby-data-794214b0bdd8#.1opwy0u3c>.
> For whatever reason (router seems the only suspect) that code does not work
> for me except for the very first time a Dash is used, at the point the
> router sees it's MAC address and gives it an IP via DHCP.
>
> Rather than figure out why it doesn't work for me or try a similar
> implementation like the one Rod pointed to,  I'm using arpalert
> <http://arpalert.org>, a relatively simple program that detects ARP
> traffic and executes an arbitrary, configured program with the MAC address
> as an argument (example shell script below). It has no dependencies beyond
> standard network libraries and is just exactly what I'm after, and maybe
> others would find it useful too. But it has to be built from source and
> there are a few wrinkles not covered by the English readme.  But for an
> expedient solution I contend the previous shell script I shared is as easy
> as an implementation is likely to get. :-)
>
> Here's an example program that arpalert can invoke when a Dash is pushed.
> The "button" variable assignment could be replaced by any arbitrary
> button-specific action, for instance Python code that does the whatsit
> transaction on the IFTTT Maker Channel, Raspberry Pi code to pull a GPIO
> line, etc. While I'm testing it the script just logs which Dash was pushed.
>
> #!/bin/sh
>
> case $1 in
>
>  (f0:27:2d:d8:26:ad) button='gatorade1';break;;
>
>  (44:65:0d:14:1e:fb) button='playdoh2';break;;
>
>  (f0:27:2d:bc:be:65) button='chlorox2';break;;
>
>  (f0:27:2d:f9:36:d5) button='gatorade2';break;;
>
>  (a0:02:dc:22:57:a7) button='chlorox1';break;;
>
>  (f0:4f:7c:e8:ec:60) button='solidgold1';break;;
>
>  (44:65:0d:21:d8:45) button='playdoh1';break;;
>
>  (74:c2:46:9a:13:bc) button='solidgold2';break;;
>
> esac
>
> date >>/tmp/log
>
> echo $button >>/tmp/log
>
>
> -Pete
>
>
> On 07/23/2016 04:53 PM, Pete Soper via TriEmbed wrote:
>
> In the past couple days I've looked at a lot of different implementations.
> I'm not willing to spend the time to determine whether that one suffers the
> same issue that keeps the other scapy-dependent implementation from working
> here. IMO arpalert <http://www.arpalert.org/arpalert.html> is an
> excellent tool for this application.
>
> -Pete
>
> On 07/23/2016 04:42 PM, Rodney Radford wrote:
>
> Pete,
>
> Have you seen this method that simply relies on the ARP requests by MAC
> address? Similar to where you are heading, but this is already complete and
> appears ready to us..
>
>
> https://familab.org/2016/02/hacking-the-amazon-dash-button-to-make-a-simple-cheap-iot-place-anywhere-networked-button-3/
>
>
> On Sat, Jul 23, 2016 at 4:02 PM, Pete Soper via TriEmbed <
> <triembed at triembed.org>triembed at triembed.org> wrote:
>
>> OK, after wading through some cosmically complex implementations of
>> "detect the button push" and finding the trivial Python program of the
>> seminal how-to involving baby diaper use only works in my house for the
>> very first button press, I wondered if these things would respond to pings
>> while they're winking and blinking. They do. Then I wondered if they
>> remember to request the same IP address over and over. They do. So, in my
>> house, where the DHCP environment is very stable for the main LAN, I can
>> arrange for a completely reliable mapping of button to IP address. So I can
>> just use the shell script below for a trivial means of detecting a button.
>> The script puts no measurable load on the computer I tried it on. I'm
>> arranging a proper scheme that keys off MAC addresses to be immune to DHCP
>> behavior using arpalert, but in the meantime I thought the group might find
>> this script amusing. (I'll publish the arpalert-based scheme when I've
>> worked out some patches to that code to get a few issues out of my face and
>> some utilities to automate the process a bit).
>>
>> To use this little script I I set up a button as usual and either use the
>> diaper-logger's Python script or simply look at the router's admin
>> interface to see the IP address dispensed. I then put that in my /etc/hosts
>> file with a name and use that in the script below. Making this script
>> general (e.g. taking the IP and text/action as parameters) would of course
>> be the next step with this approach. Anyway, this script might be of
>> interest to folks that just want to play vs installing scapy or a hundred
>> Javascript modules. I' about 99 3/4% sure this would work on Windows using
>> Cygwin.
>>
>> One interesting side effect of setting up a bunch of buttons is that my
>> phone is simply filled with reminders about the fact that I never selected
>> a product for each button. So I would add to the usual instructions out on
>> the net "after setting up the last button, uninstall the Amazon app!"
>>
>> #!/bin/sh
>>
>> while [ /bin/true ] ; do
>>
>>   ping -w 1 -c 1 gatorade1 >/dev/null 2>&1
>>
>>   if [ $? -eq 0 ] ; then
>>
>>     echo "You can get your own Gatorade" | espeak --stdin
>>
>>     # make sure we don't double trigger
>>
>>     sleep 10
>>
>>   fi
>>
>> done
>>
>>
>> -Pete
>>
>> _______________________________________________
>> Triangle, NC Embedded Computing mailing list
>> TriEmbed at triembed.org
>> http://mail.triembed.org/mailman/listinfo/triembed_triembed.org
>> TriEmbed web site: http://TriEmbed.org
>>
>
>
>
>
> _______________________________________________
> Triangle, NC Embedded Computing mailing listTriEmbed at triembed.orghttp://mail.triembed.org/mailman/listinfo/triembed_triembed.org
> TriEmbed web site: http://TriEmbed.org
>
>
>
> _______________________________________________
> Triangle, NC Embedded Computing mailing list
> TriEmbed at triembed.org
> http://mail.triembed.org/mailman/listinfo/triembed_triembed.org
> TriEmbed web site: http://TriEmbed.org
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.triembed.org/pipermail/triembed_triembed.org/attachments/20160724/93700b11/attachment.htm>