Lets Hack It


Hacking Dimmer Touch Panel with ESP8266

Two rectangular wall-mounted dimmer switches, black and white, with volume control buttons.

Hacking Dimmer Touch Panel with ESP8266 I bought two of these LED Touch Panel Dimmers in Banggood and they look pretty good. But since my house automation has its own way to controlling the lights I wonder if I could hack them to send info to Home Assistant. The first thing I opened one of them to check what’s inside. It has two boards connected by a Flat Cable Touch Panel Board Dimmer Board The dimmer board does have some micro controller that looks like a PIC, few mosfets and a buzzer. The touch panel has a WTC801SPI controller. WTC801SPI...

Creating your own GSM Network with LimeSDR

Terminal output showing OsmoTRX software logs and configuration settings for a radio transceiver.

Creating your own GSM Network with LimeSDR DISCLAIMER: This procedure is highly illegal basically anywhere in the world. Be sure to run this in a closed RF environment (aka Faraday Cage) This article works with any LimeSDR version. For this example we will use the Osmocom GSM Stack in the NITB (Network in the box) mode. In this mode the phones connected to you BTS will be able to call each other and send SMS messages. There is also the Interconnect mode in which the BSC (Base Station Controller) connects to a ISDN or IPBX (for example Asterisk) to manage...

Dahua / Intelbras MitM Attack

White dome security camera with Intelbras branding and lens visible.

Dahua / Intelbras MitM Attack How to perform a very simple MitM Attack on a Intelbras/Dahua IP Cameras / DVR. This uses Ettercap to do an ARP Poison and a simple GoLang Script to fetch the username/password. Disclaimer: This type of attack is basically illegal anywhere in the world. My intentions with this tutorial is to demonstrate why you should ALWAYS use a TLS connection for ANYTHING. Use for you own risk. For the purpose of responsible disclosure, I contacted Intelbras on Twitter on 11/08/2019 and let them know I expected a reply from them until 17/08/2019. If they didn’t...

Reverse Engineering cheap chinese "VRCAM" protocol

White dome security camera with central lens, speaker grilles, and mounting holes on perforated surface.

Reverse Engineering cheap chinese “VRCAM” protocol That’s not the first time I get a Chinese hardware that has some proprietary protocol that does not follow a single standard. It’s funny because when you get a VERY cheap thing, you expect to use many standards as possible to reduce the development cost, but some chinese developers just want to do it yourselves. I present you the “VRCAM” and it’s SOUP protocol (any relation to SOAP is just a mere coincidence :P) The Hardware Let’s first start with the hardware itself. It’s a 2 Megapixel sensor with 1280x960 video resolution. It features...

GOES GRB First Light!

When the GOES-16 was first announced I got interested in their GRB Downlink (although the first try was at HRIT downlink). Basically GRB is a replacement for the old PDR downlink in GOES 13/14/15 generation, which gives few advantages over the old link: Uses market standard DVB-S2 Generic Stream Have FEC (as defined by DVB-S2) Higher bandwidth Easier to receive due DVB-S2 FEC For those who don’t know, the GRB is a direct rebroadcast of GOES data, with minimum processing as possible (usually just packaged into NetCDF files with calibration parameters) and is intended for anyone that want’s to get...