Amazon Dash Button Hacking

Published: 17 July 2016
on channel: RandyInLA

476

INFO:
I followed Mark Gibbs article on Dash hacking @ NetworkWorld, slightly altering his code to force whichever interface I wanted and some other small tweaks.
http://www.networkworld.com/article/2...

DASH HACKING:
When the Dash buttons wake up to place an order, they contact your local WiFi router to get an IP address using ARP packets. Most of the hacks I've seen have code that listen for each unique MAC address in the ARP packet to determine which button has been pressed. I'm using an Apple Time Capsule WiFi router and, for some reason, it sometimes passes the original ARP packet (with the original MAC address) to the LAN and other times, it rebroadcasts the ARP packet using its own Ethernet MAC address. It would also sometimes spit out 2 to 6 ARP packets, as if the button was pressed multiple times. When I go to add actions to the presses, I'll have to take into consideration a debounce time of like 5 seconds so I don't get multiple actions.

In both cases, luckily, I found the destination_IP address was the current IP address of the button. I decided to add entries that always map certain IP addresses to those buttons so I can listen for either the original MAC address, or the Time Capsule MAC address and an IP address to make the match.

I have some other WiFi hotspots in boxes somewhere. I'll probably pull 'em out and see if they always forward the original ARP packets to make detection a little more straight forward.

TWO DAYS OF RECONFIGURATION HELL!
I wasn't able to sniff at first and wasn't sure why, so I decided to reconfigure my Arris router/gateway as just a bridge. That fixed the "Double NAT" issue the Time Capsule was complaining about. I then configured the bridge, TC and a few computers for IPv6 protocol. The Time Capsule is hard wired to use /64 bit prefix and Time Warner uses /56. I assume this is what caused the Time Capsule to lock up and not complete booting when connected to the Internet. This prevented me from making any changes to the TC settings! I figured out that for any configuration change, I have to unplug the TC from the Internet and the changes will go through. I can then plug it back in after and it gets both an IPv4 & IPv6 address and all routing works.

On this page of the site you can watch the video online Amazon Dash Button Hacking with a duration of hours minute second in good quality, which was uploaded by the user RandyInLA 17 July 2016, share the link with friends and acquaintances, this video has already been watched 476 times on youtube and it was liked by 1 viewers. Enjoy your viewing!