The Hash Monster: ESP-32 Tamagotchi for WiFi Cracking | Hacker News Reader

The Hash Monster: ESP-32 Tamagotchi for WiFi Cracking

telescope.ac

180 pointswolframio28 comments

If you enjoy this kind of RF hacking tool, you may enjoy the Flipper Zero even more:

It has 125kHz RFID (for cloning door access badges) and a 433 MHz transceiver (for cloning garage door / barrier remotes). This is much more desireable for me than Wifi.

Wish I could get the same capabilities in a phone case format so I could clone all my different badges into something I carry with me all the time.

Flipper Zero is great! I just pledged them last month on Kickstarter.

I just today decided to build a Pwnagotchi[0], and I've got a spare M5Stack[1] sitting in a closet, so it looks like I now have two projects for this weekend!

Even though the ESP family has been around for a while, I continue to be amazed by what people can accomplish with such resource constrained (by today's standards) embedded systems.

[0]: https://pwnagotchi.ai/

[1]: https://m5stack.com/ (also linked in the blog post)

HashMonster got your m5stack covered, yo:

https://telescope.ac/petazzoni/the-hash-monster-esp32-tamago...

Pwnagotchi was a lot of fun when I was actually commuting to work and travelling through the city and other dispersed areas. Not so much for me now.

By today's standards, indeed. Those devices are very powerful for their size. A single one would be able to coordinate a fleet of moon landers.

Be careful what data you collect: https://en.m.wikipedia.org/wiki/Joffe_v._Google,_Inc.

https://en.m.wikipedia.org/wiki/Joffe_v._Google,_Inc%2E

HN eats the last period; you can use %2E to avoid that.

I think you're probably pretty safe as a private individual doing this for fun or as part of red team ops. If you launch a worldwide dragnet for this kind of data and then publicly use that data as part of your commercial offerings, the story changes somewhat.

That case never went the full distance. Google's motion to dismiss was ultimately denied, but the case settled for 13 million; it never went to trial and class members did not recover any damages under the Wiretap Act. As such, the only thing we can conclude is that in the 9th Circuit, WiFi is covered by the Wiretap Act. We cannot conclude from this decision that sniffing WiFi on its own has resulted in liability for damages. That issue was left unresolved.

Love these types of projects. I built the pwnagotchi last weekend and documented the process on YT https://youtu.be/2DIPVpcjR1I

I might have to find some part for this now...

I have one of these lying around (and spent a couple of hours setting up an ESP32 camera to work with HomeKit, so this seems like a fun follow-up). The M5Stack range is loads of fun.

I don't know how much confidence I would put into this, but there is an amazon listing: https://www.amazon.com/M5Stack-Development-Extensible-Contro...

If you want one, they look to be cheaper at adafruit ($34 or $42 if you want the motion sensor): https://www.adafruit.com/product/4178 https://www.adafruit.com/product/4177

or mouser: ($43): https://www.mouser.com/Search/Refine?Keyword=M5Stack+ESP32

It seems like to protect against this, I should have a long password and not use words (e.g. mix numbers for letters). Is that correct?

10-12 "random" characters + WPA2 and you're safe.

And have no children to ask you what the wifi password is.

Long password of phonetic pronounceable gibberish is also an option.

I would love if the software stack were extended for on the go usage:

Use HashMonster to capture packets. Send those packets to my mobile phone via bluetooth. Phone sends it to my PC running at home via mobile data plan. PC cracks the password, returns back to phone.

That way I can crack passwords to wifis while waiting somewhere if I dont want to eat my data limit

kinda amazed you can get a microcontroller SOC board w/ case, battery and a screen for about 50 bucks shipped.

And if you are willing to compromise on the lack of case and a smaller screen you can get them for as low as 6 bucks shipped. Look for the ttgo esp32 with usbc and integrated lipo charging circuit, can highly recommend them!

Also recommended here.

Check these out. ESP32 (wifi+bluetooth), lora radios, GPS, oled screen, and battery holder - ~$25US:

https://www.aliexpress.com/i/32967228739.html

I have four of them, all work exactly as described.

And what tda is talking about for ~$8US: https://www.aliexpress.com/item/32824839148.html

Or no screen, but with an SD card slot for %5US: https://www.aliexpress.com/item/32846099054.html

I bet that last one would run Hash Monster just fine - if you need a screen for feedback - they're under $3: https://www.aliexpress.com/item/32922106384.html

The LILYGO® TTGO T-SIM7000G also makes a great autonomous wigle throwie.

tindie.com/products/ttgo/lilygor-ttgo-t-sim7000g/

Ooooh. A nano SIM and an LTE antenna. But no quickly googlable info about what cellular capabilities it has. I'd _assume_ it does 3G/4G/LTE? Have you ever used that? (We don't have any GSM/2G left where I am, so a lot of the inexpensive cellular project boards dpn't work here any more...)

I ordered one several weeks ago from their tindie store, I'm still waiting on delivery. Spec sheet says global-band LTE. I've read that the ~free (they might be $10?) google fi sims cards 'just work'.

Apologies for the implied existing success.

It is based on SIM7000G, which is LTE CAT-M1(eMTC) and NB-IoT. So "4G".

Oooh, thanks!

(Goes back to still open tab to order a couple... Don't now what for yet, but you know shrugs:. Hmmm, I've got Meshtastic running on some other TTGO boards, I wonder how much work it'd be to bridge two LoRa mesh networks together over SMS or the internet?)

ESP32 is crazy versatile. Too busy and should not add more project but this is very interesting and the 433 one mentioned below.

Reply on news.ycombinator.com