41–50 of 213 posts
On reset it should still verify the server cert when it tries to call home, but since you have access to the image you can replace that (if they didn't stash it somewhere securely, that is).
Nice analysis. I think the author really hit on the key problem: expensive BOM due to poor engineering choices.
The entire project looks like the result of a high school student's first Instructables. It's hilariously under-engineered and it's clear that these folks had absolutely no idea of how to build a product, IoT or otherwise. Hint: if your product plans involve a raspberry pi, you probably fucked up.
Earlier quoted context omitted.
The generic name for these panels are "HUB75", based on the interface they use for driving them. I can confirm, these are $10-15/ea in small quantities on sites like Aliexpress. But you're likely right, they were probably buying retail from Adafruit.
Why would you buy retail if you are a company buolding and selling hardware to begin with?
It's a shame because there is a small but sustainable business here.
Earlier quoted context omitted.
The generic name for these panels are "HUB75", based on the interface they use for driving them. I can confirm, these are $10-15/ea in small quantities on sites like Aliexpress. But you're likely right, they were probably buying retail from Adafruit.
Why would you buy retail if you are a company buolding and selling hardware to begin with?
Why would you think that a company using a $25 Adafruit HAT that could be found for a magnitude less elsewhere would be using cheap LED matrices?
Put another way, what from the article gives you enough confidence to say that they would have used cheaper parts?
Taking over their DNS isn't going to help if they did things correctly. If they did things right each device is going to be doing cert verification with AWS IOT, and that verification will fail. That's client and server cert validation, unless they turned that off. On reset it should still verify the server cert when it tries to call home, but since you have access to the image you can replace that (if they didn't st…
The sign did use AWS IoT for real time configuration updates however initial configuration was pulled from their HTTP server. Using the vulnerability I describe in the article I just remove the connection to AWS IoT.
(twitter @bettercaltrain)
Taking over their DNS isn't going to help if they did things correctly. If they did things right each device is going to be doing cert verification with AWS IOT, and that verification will fail. That's client and server cert validation, unless they turned that off. On reset it should still verify the server cert when it tries to call home, but since you have access to the image you can replace that (if they didn't st…
This is just straight up gaslighting. “That thing you said you did isn’t going to work”.
I build something similar https://sschueller.github.io/posts/vbz-fahrgastinformation/ but with way less BOM and I keep getting asked that I should sell them. The primary reason I don't is because I don't want to support something like that for the next 10 years...
Earlier quoted context omitted.
Did you intentionally leave out Arduino from the "what to drive with" options?
Assuming largish, multi-color matrixes, and/or chained ones, yes. A ~10Mhz+ pixel clock, double-buffering, or just the size of the pixel map would strain most of those. This sign is 32x128 pixels, with each pixel taking data for RGB (on/off), with the PWM rate controlling brightness for each of the three colors. Though there are examples of using something beefier/faster like an ESP32. There's also in this case, the…
Hello, author here. Happy to answer any questions! My apologies for the downtime, I wasn't expecting much traffic today since I submitted the post to HN yesterday but I've started scaling my server now!