Thursday, May 28 2015
I bought an Amazon Dash button just when it was released. A few weekends ago I had time to play with it and here is my write up. This is not really a security write up, I was just interested in how it works. There is a decent hardware focused overview available here: Inside the Amazon 802.11b/g/n Dash Button. This overview is more on the software side!
Summary:
The Dash button connects to Wifi and sends a HTTP POST every time you press the Dash's button.
The Dash is completely shutdown until you press the button, it will switch off seconds after the HTTP request is done with a small timeout to wait for the server's reply. The HTTP connection is protected via SSL but the Dash button doesn't check the certificate and can be easily intercepted. The main part of the data exchange seems to be the Dash Serial Number (DSN).
Background
The Dash button is a simple way to reorder a specific item from Amazon.
The item that is ordered needs to be preselected at setup time, so far each button
only allows you to select from a very small list of related items.
My Cottonelle button only allows to pick one out of four Cottonelle products.
So unfortunately you cannot just order ANY Amazon item :-(
Below: my mock-up for what people actually want to use the Dash button for (beer, bacon and condoms).
Setup
The setup process is pretty straight forward. You install the Amazon app on your phone and go to My Account and select the Dash Button menu.
The app takes you through the steps and your Dash is configured.
Some interesting parts of the setup are.
Wifi setup
The Wifi is configured from the app using an audio channel. In the setup mode of the Dash
it receives the audio and demodulates it to set the Wifi network name and the password.
In addition to the audio based configuration the Dash also creates a Wifi access point named Amazon ConfigureMe. Once you connect to it you can go to http://192.168.0.1 and configure the Wifi settings via the web interface. Once you click Configure the Dash reboots. I actually didn't manage to connect the Dash after configuring it through the Wifi interface (I also didn't try that hard).
As the last part of the setup you select that product you want to reorder every time you press the Dash button.
Investigation
While playing with the Dash I discovered a number of small things.
Open Ports
The Dash opens ports 80 and 443. I was NOT able to connect to 443. Port 80 obviously provides the web interface to configure the Wifi settings (previous paragraph).
DHCP
The Dash shows up as WICED*DHCP*Client on your Wifi router host list.
Networking
All communication goes to parker-gateway-na.amazon.com on port 443.
The Dash button does NOT check the certificates so you can easily MITM it and look at the network traffic.
I used my Wifi router's DNS service to resolve parker-gateway-na.amazon.com to a local IP address running webmitm (from the dsniff package). Using the generated key/cert you can easily look at all the network traffic using ssldump or wireshark.
How to generate network traffic without ordering anything!
The one problem with the Dash is that it is only online (connected to the Wifi) for a short time when you press the button. Pressing the button will initiate an order, so playing with your Dash could end up in a lot of toilet paper showing up at your doorstep.
One easy way to avoid this is by skipping the last step of the configuration. If you skip that last step your Dash button thinks it is configured but the backend doesn't. The last step of the configuration is selecting the product you want to order. Basically you need to quit/kill the Amazon app when it asks you to select a product for your Dash button. Once you do this you can press the Dash button as often as you want without triggering an order of toilet paper. The Dash button will come online connect to your Wifi and connect back to the Amazon backend. This gives you the time to collect network traffic or port scan the Dash.
Dash network traffic
I only looked at the traffic between the Dash and the Amazon server. I didn't look at the traffic from the Amazon app to the Amazon server during setup. I should have done this but I didn't. Now I don't have the time to do it. I barely have the time for this writeup.
From what I can see the Dash sends only a few messages to the server. The first thing you see is that the messages always contain the Dash serial number (DSN) that is printed on the back of the Dash button.
All communication is carried out via HTTP POST. Content-type is set to: binary/rio. The encoding is set to chunked. The encoded data is a mix of ASCII and binary with a length fields for specific parts. I didn't have the time to reverse the message format, I just took a brief look at it. The last part of each message seems to be 20 bytes of binary data.
During setup the Dash sends some data such as RSSI values to the Amazon backend. There is a status bit field message and of course there is the message that is sent when the button has been pressed and the Dash thinks it is fully configured. If the Dash thinks it is not setup correctly pressing the button will just lead to a blinking red light.
If it thinks it is configured it will connect to the Wifi and send a specific message. The message is rather short and mainly consists of the DSN followed by the 20 bytes of binary data. The server answers to this with different messages. The only message I saw so far was the message for a not fully configured Dash button (HTTP 412 Precondition Failed). So far I was not in the mood to actually order something. I leave this exercise for other people.
Package Captures:
Message sent during setup:
Some status message:
Some message sent from the Dash to the server:
Message sent when the Dash button is pressed and the Dash thinks it is configured:
Server answer when the Dash button does not have a product associated:
Conclusion / stuff to do:
The Dash seems like a fun toy, I wish you could just configure it to order any item from Amazon.
I know the current version is just a trial and I hope in the future they will allow you to select any product.
One thing that I found strange is that there is no back communication from the server to the Dash button at setup time. The only message that is sent from the server to the Dash is after the server receives an order item message after pressing the Dash's button. This must mean that you can either modify the message and change the DSN to initiate an order for another Dash button. OR The last 20 bytes provide integrity protection for the message.
Hacking Todo List:
Sniff traffic of an actual order. Specifically the answer from the server.
Open the device and dump the firmware!
Reverse message format. What are the last 20 bytes in the message? My guess this is for integrity protection. Like an HMAC. But this is just wild speculation.
Sniff communication between Amazon App and server during Dash setup.
Happy further hacking!