1024-bit Encrypted, Cloud-Based Garage Daniel Ng 2012 @embeddedmelb *Desired Encryption level proportional to paranoia **Cloud-base-edness optional extra
What?• Open your garage door from your phone• Over Wi-Fi• Secure-enough• Could be over the Internet if you really want
Why?• Garage only had 1 working remote control• Original replacement cost $200+• Dodgy after-market replacements• Phone == Universal Controller• Just for fun, curiosity, learning.
The Gear• Original push-button local wired controller• Any phone with an SSH Client• Dreamplug (overkill)• mbed (also overkill)• Simple transistor switch circuit
Dreamplug• Fanless Plug Computer• <5W consumption• Built-in Wi-Fi Access Point• Runs Linux• Many other bells & whistles
Phone• Phone connects to Dreamplug’s built-in Wi-Fi Access Point• Phone logs in to Dreamplug with specific username eg. ‘g’• Use any phone with a SSH Client• Eg. ‘ConnectBot’ on an Android Phone• Optional: – ConnectBot also has Public-Key Encryption feature • Convenience of not having to type a password
Hacking The Dreamplug• Hack /etc/passwd for user ‘g’: g:x:1000:1000:g,,,:/home/g:/sbin/garage• Create /sbin/garage: #!/bin/sh echo "ggg" echo 1 > /dev/ttyACM0• Optional: – Create (eg. 1024-bit) public-key pair for convenience of not having to type password: ssh-keygen
mbed• 32-bit ARM Core• USB• Lots of GPIOs• Many other bells & whistles
Now What?• GPIO pin on mbed goes high for 1 sec.• We want this to cause the button on the old controller to be pressed – ie. close the circuit across the button terminals• How?
Transistor Circuit• Transistor acts as a simple switch
Transistors Simplified• Current entering the Base flows when the mbed’s GPIO goes HIGH• The Collector is wired to one of the button terminals• The Emitter is wired to the other button terminal• Current entering the Base causes current to flow between the Collector and Emitter ie. closing the circuit between the button terminals
Summary• Phone connects to Dreamplug’s Wi-Fi Access Point• Phone logs in• Dreamplug executes hacked login script which sends a ‘1’ to the USB port• mbed sees the ‘1’ and turns on the transistor switch• Transistor switch ‘presses’ the garage door button