hack – Terence Eden’s Blog

Responsible Disclosure: Content Injection flaw in Gett's Website

@edent — Wed, 26 May 2021 11:21:30 +0000

Bit of a boring write-up, but here we go.

Taxi app Gett had a content injection flaw in its search function. By searching for an HTML string, it was possible for an attacker to add links or images to a page. It was really hard to contact them - but the threat of media attention sprung them into action.

For example, searching for a specially crafted string meant that an arbitrary SVG could be drawn onto the page like this:

Or just a regular element:

Links could also be added - like this: That would have allowed an attacker to bypass email spam filters, by sending links which apparently went to a trusted site. It's also useful for search engine poisoning.

Similarly, the entire page could have been rewritten if the attacker crafted the right sort of HTML and CSS.

Luckily, the form rejected and

The 3rd party's site was hacked, and the JS was changed.

BA's customers ran the script, which then harvested their credit card details as they were typed in.

This should have been a wake-up call to the industry. Don't load unauthenticated code on your website - and especially not on your payments page.

If you absolutely have to load someone else's code, check to see if it has been altered. This is done using SubResource Integrity (SRI).

SRI tells the user's browser to check that the code hasn't been changed since the website was published. It looks like this:

If even a single bit of the code has changed since it was added to the page, the browser refuses to run it.

Who isn't using this

Deliveroo

Gig-economy food flingers add in code from CDNJS.

What's especially annoying about this, is that the CDNJS website has a "one-click copy" for SRI.

Spotify

Their payment page loads code from live.adyen.com Adyen are their payment provider - so if they get hacked, credit card details are going to get compromised. But how much easier is it for an attacker to subtly change their JavaScript than to hack their entire mainframe?

The Guardian

Despite being a tofu-knitting member of the bourgeoisie, I am yet to subscribe to teh Gruan. If I did, I'd risk their affiliate tracker going rogue and stealing my organic credit card details. Bonus points for leaving a handy pointer to their internal Google docs...

Fanduel

Sports betting site running unverified scripts from external sources. They've also got external style-sheets

If an attacker can change the JS or CSS, they could compromise users of the site.

EasyJet

I feel a bit conflicted about this one. You can probably trust Google not to get hacked. Right?

Google supports SRI - but doesn't mention it anywhere on their Hosted Libraries site.

British Airways!

Yup! They've not learned their lesson. Three pieces of unverified code running on the payment page.

Maxymiser is an A/B testing and analytics tool. Run by Oracle now. Most ad-blockers prevent it loading.
Google's reCAPTCHA. If that gets hacked, half the planet is compromised.
SiteSeal "proves" your site is secure by displaying a image. No, I don't understand that either.

This does not make the site magically secure.

All three of them are highly trustworthy. But if you're BA and you've already been bitten by bad security practices, doesn't it make sense to go full "belt-and-braces"?

...and more?

These are just a small sample of the sites I've found. SRI has been available for two years and it still isn't being used enough.

Responsible Disclosure

I've reported this issue to a few sites by using responsible-disclosure aggregator HackerOne.

Typically, my warning goes unheeded with a response like:

Based on your initial description, there do not appear to be any security implications as a direct result of this behavior, this is an Informational issue at best, unless you can prove those third-party domains can be compromised in any way.

This appears to be more of a risk acceptance rather than a vulnerability. Although there is no PoC for this report, I will forward the information to the customer and see where to go from there.

That's fair enough. I'm not expecting a huge payout and it is only an informative report; I can't prove that the external sites are vulnerable. But there really ought to be a concerted effort to make payment sites as secure as possible.

This needs to be taken seriously. If you're handling users' details, you need to take every possible step to keep them secure.

Redirect GitHub ID to Username

@edent — Thu, 22 Nov 2018 12:01:00 +0000

Scratching my own itch here...

GitHub users have a username (mine is @edent) and have a user ID number (mine is #837136).

If you want to redirect a user ID to a username, you can use the little service I've cobbled together:

https://edent.github.io/github_id/#837136

That will take your browser to my GitHub page, using nothing but my ID.

Why?

Some login services only give you the GitHub user's ID.
GitHub users can change their username - but their ID stays the same.

How?

Inspired by Caius Durling's useful GitHub username to ID service.

Mine is a scrap of JavaScript which uses this undocumented endpoint to get user info.

Feel free to copy it, or use https://edent.github.io/github_id/#837136 as a handy little webservice.

Telnet control of Toshiba Smart TVs

@edent — Sun, 11 Nov 2018 07:17:36 +0000

Here's how to control the Toshiba 49U6863 - and other similar models - using Telnet.

Quickstart

At the command prompt, type telnet 192.168.0.123 4660 then type 1012 and your TV will turn on. MAGIC!

Background

After six years of use, I decided to upgrade my old 37 inch Panasonic TV. I know Toshiba aren't the coolest brand around, but the 49 inch monster was half the price of the old TV. Yay Moore's Law!

BUT! It turns out that Toshiba don't actually manufacture their own TVs. They just rebadge screens made by Vestel - a Turkish company.

And, the Android remote app is made by Cabot Communications. It is pretty crappy.

Neither Vestel nor Cabot are interested in providing documentation, or any technology support. Hmmm... Reminds me, I need to do a GPL request to Vestel...

So it is up to fearless hackers to reverse engineer what they've done.

Open Source To The Rescue!

Before trying anything yourself, see if someone else has done the hard work for you. Teemu Mikkonen had already written some code to control his Vestel TV. It didn't quite work with the Toshiba models, but gave a good starting point.

WebSockets

The TV has a WebSocket interface, which broadcasts some information. Here's a scrap of JavaScript to show you the basics:

var TV = new WebSocket("ws://192.168.0.123:7681/")
TV.onmessage = function (event) { console.log(event.data); }

As you play about with the TV, you'll see various messages pop back - but they're not that useful.

Port Scan

Like all good movie hackers I use nmap. Here's what it reported to be open:

2870/tcp open unknown
4660/tcp open mosmig
4661/tcp open unknown
4725/tcp open unknown
7681/tcp open unknown
56789/tcp open unknown
56790/tcp open unknown
57707/tcp open unknown

I hit the jackpot with the second port! telnet 192.168.0.123 4660 got me in. 1337 h4x0r!

Who's got the button?

I used JADX to decompile Toshiba's Android remote app.

Here are the button codes I found:

BUTTON_HOME 1046
BUTTON_POWER    1012
BUTTON_POWER_NAV    1012
BUTTON_POWER_PLAYER 1012
BUTTON_POWER_PVM    1012
BUTTON_POWER_GES_NAV    1012
BUTTON_POWER_GES_PLAYER 1012
BUTTON_POWER_GES_PVM    1012
BUTTON_RECORD   1051
BUTTON_PLAY 1025
BUTTON_PAUSE    1049
BUTTON_STOP 1024
BUTTON_PREVIOUS 1034
BUTTON_REWIND   1027
BUTTON_FORWARD  1028
BUTTON_NEXT 1255
BUTTON_SCREEN   1011
BUTTON_LANG 1015
BUTTON_SUBTITLE 1031
BUTTON_PRESETS  1014
BUTTON_EPG  1047
BUTTON_TEXT 1255
BUTTON_FAV  1040
BUTTON_3D   1040
BUTTON_SLEEP    1042
BUTTON_0    1000
BUTTON_1    1001
BUTTON_2    1002
BUTTON_3    1003
BUTTON_4    1004
BUTTON_5    1005
BUTTON_6    1006
BUTTON_7    1007
BUTTON_8    1008
BUTTON_9    1009
BUTTON_MENU 1048
BUTTON_MUTE 1013
BUTTON_UP   1020
BUTTON_LEFT 1021
BUTTON_OK   1053
BUTTON_RIGHT    1022
BUTTON_DOWN 1019
BUTTON_VOL_UP   1016
BUTTON_VOL_DOWN 1017
BUTTON_VOL_UP_2 1016
BUTTON_VOL_DOWN_2   1017
BUTTON_PROG_UP  1032
BUTTON_PROG_DOWN    1033
BUTTON_BACK 1010
BUTTON_EXIT 1037
BUTTON_RED  1055
BUTTON_GREEN    1054
BUTTON_YELLOW   1050
BUTTON_BLUE 1052
BUTTON_INFO 1018
BUTTON_MMEDIA   1057
BUTTON_SOURCE   1056
BUTTON_SWAP 1034
BUTTON_CHAN 1045
BUTTON_QMENU    1043

The good news is that the codes perfectly emulate a remote button push, so CEC passes the controls onto devices connected via HDMI.

Security? Where we're going, we don't need security!

Sadly, Vestel TV's are notorious for their lax security. This Toshiba branded one seems to have fixed most major flaws - I wasn't able to execute commands as root on the TV, for example.

But two minor privacy flaws are apparent. Any device on your home network can:

control the TV.
see its status messages.

Other vulnerabilities may be present, but Toshiba helpfully brands its TVs as "Secure".

I couldn't find any details about the Bavarian State Government's certification programme - let's hope it's good!

Reflections on #EMFcamp - a Science-Fact Convention

@edent — Sun, 09 Sep 2018 09:06:22 +0000

At a science-fiction convention, you queue for hours to hear a bit-part actor describe what it was like on the set of a forgotten sci-fi show. At a science-fact convention, you have a beer with a person who is literally changing the world with a laser cutter, some diodes, and a smattering of Python.

Welcome to ElectroMagnetic Field!

(I've stolen the subtitle from Ken MacLeod's description of Charles Stross's story Dechlorinating the Moderator.)

I'm not one for camping. Or doing anything in a field. So I was quite nervous about attending the festival. But everyone was lovely, the talks were amazing, and the food was good.

At every turn I bumped into people doing amazing things. Robots! LIDAR! Science! It was blissful. And the cider was pretty cheap.

I've never been to a laser powered rave watched over by a robot cat, while people covered in LEDs danced under posters promoting genetic modification on the BlockChain. I've never sat in a tent while watching a material scientist demonstrate her craft - and then later gone back to the same tent to watch a Chap Hop singer strut his stuff.

EMF is weird!

Bug Reports

These are all P3 or lower.

As a sleeper, I don't want to be woken up in the middle of the night by air-horns. I'm quite happy for "bangin' chooons" to pump out - but my ear-plugs are not designed to cope with klaxons being fired off.
As an audience member, I don't want to watch 20 minutes of a presenter figuring out how to connect a laptop to a projector. All presenters should have to use the pre-configured stage laptop. I only saw one talk which needed a specialist laptop - to show the audience a view from a USB camera.
As someone who eats food, I don't want to queue for 30 minutes only to be told the advertised vegetarian breakfast isn't available. This is a problem unique to UK food-trucks. They seem taken by surprise that customers want to give them money. A few of the trucks were excellent, and knew how to serve food quickly. Still, an excellent range of veggie food.
As someone who wants to ask a question at a talk, I don't want to be stuck behind someone saying "Less of a question, more of a comment." These people need to learn some manners!
As a wishy-washy-bleeding-heart-politically-correct-do-gooder, I'd like to have seen more diversity. There was no lack of age or gender diversity, but it all felt a bit white.

Highlights

We accidentally hired a very silly campervan. Which lead to...

I did my talk about The (Connected) House of Horrors and loads of people came!

My brilliant wife did a talk about our OpenBenches project.

I met so many new people, reconnected with old friends, and put faces to Twitter avatars. I had my mind expanded about LGBTQ+ behaviour in animals, saw people hacking their way through insurmountable technical obstacles, and was inspired by all the beauty and creativity on show.

Roll on EMF 2020!

Enabling Voice-Over-WiFi on the OnePlus 5T and Three UK

@edent — Fri, 31 Aug 2018 11:21:40 +0000

My mobile provider - Three UK - offers WiFi calling, but only if you have a phone purchased directly from them. For everyone else, they have a crappy app which hasn't been updated in two years.

So, let's break out of their artificial restrictions and get some WiFi calling on the OnePlus 5T!

Step-by-step

Open your phone dialler app.
Dial *#800#
You don't need to press send, you should automatically be taken to this engineering menu
Touch the top menu item "oneplus Logkit"
Scroll to the bottom
Press "Function Switch"
Select "VoWifi switch"
Your phone will ask to reboot - so press OK to reboot
Once the phone has restarted, go to your Settings menu
Select "SIM & network"
Scroll down and select "Wi-Fi calling"
You can optionally switch the "Calling preference" to "Wi-Fi preferred". If you do that, calls will go via Wifi even if you have a mobile signal.

Test it!

Put your phone into Aeroplane mode, then switch on WiFi. You should see this logo at the top of your screen.

Try to make a call.

It doesn't work??!

If this doesn't work for you... sorry! You should speak to your network provider to see what they recommend.

Advertising Screens Hacked To Mine BitCoin

@edent — Sun, 11 Feb 2018 11:21:37 +0000

Spotted in London, yesterday. A large, Microsoft Windows-powered advertising hoarding has been hijacked.

It's not uncommon to see broken-down Windows displays - I run https://windowsisbroken.tumblr.com/ - which is dedicated to pointing and laughing at such mistakes. But this is the first time I've seen a display repurposed for profit!

It appears to be running NiceHash Miner Legacy. A BitCoin mining program for older computers.

I'm sure someone cleverer than me can figure out which wallet starts with 3Jgi6 and is receiving these coins.

Although, given that the hash-rate is zero, it may not be producing anything.

There's no way to know whether this is an external hack, or if an "enterprising" employee has decided to repurpose these computers on the weekend, or if the advertising industry has decided that mining is more profitable than encouraging people to enjoy a cool refreshing glass of blue milk.

If you've enjoyed this blog post, you can pay me in BitCoin.

Solar Battery and Alexa - in 30 lines of code

@edent — Sat, 04 Nov 2017 10:38:49 +0000

Amazon Alexa is a fun little bit of kit. But it can be tricky getting it to work with all your smart devices. Not every company has an Alexa skill - just like not every company has an app.

Using Flask-Ask it is possible to bring Alexa smarts to a range of previously mute devices.

Alexa coding works on "intents" - the following is a simple intent. That is, you can only ask the skill one thing. No state is maintained, no multiple commands to get right, no complexity. This gets information from a single source and speaks it.

Code

The basic Python is pretty simple and can be adapted to query almost any basic JSON API. Let me walk you through it.

All the boilerplate needed to set up the skill:

import logging
from operator import itemgetter

import requests
from flask import Flask
from flask_ask import Ask, statement

app = Flask(__name__)
ask = Ask(app, '/')
logger = logging.getLogger()

@ask.launch
def launch():
    return stats()

The API that you want to call. This is a basic JSON API which doesn't require authentication.

ENDPOINT = "https://example.com/api/maslow.json"

Here's the main part of the Skill. When the intent is triggered, call the API. Get the data and format it for speech. If there was an error, tell the user.

Make sure that the name of the intent is identical to the one you set up in the Alexa Developer console.

@ask.intent("BatteryIntent")
def stats():
    r = requests.get(ENDPOINT)
    data = r.json()

    if r.status_code == 200:
        percent = data['battery/amphours']
        speech = "Your Moixa battery is at " + str(int(round(percent))) + " percent capacity right now."
    else:
        speech = "There was a problem connecting to the battery."

    logger.info('speech = {}'.format(speech))
    return statement(speech)

Short and easy.

Deploying

Again, Amazon don't make it easy to deploy Alexa skills - here's a guide to getting started using Zappa.

Remember, Alexa is not AI. You must painstakingly type in all the "utterances" that you think your users might say to activate the skill.

Problems

There is one major problem with retrofitting Alexa skills.

Lots of Internet connected devices have no ability to log in remotely - and certainly don't have the OAuth systems that Amazon demands. Alexa has no ability to directly connect to IP addresses on its own subnets.

This means most skills will need hard-coded credentials - and a way to traverse into your network.

In short, this means means they can't be shared on the Amazon store.

Creating a generic, open source, check-in app

@edent — Thu, 06 Apr 2017 18:02:53 +0000

Many years ago, when Foursquare was still cool, I built an app to let people check into chocolate bars. You know, "@edent is eating a Wonka Bar classic. 4/5?"

It was a quick and dirty hackday project. Ever since, I've had the hankering to build something a bit more generic. I currently use Untappd to check into beer and Vivino for wine.

I'd like to be able to check in to:

Artwork
Boardgames
Cheese
... Things beginning with "D"...?

So, here's my half-day hack to make that happen. Code quality is awful!

Minimum Viable Check-In

At the most basic level, we need a list of things. A user searches through the list, finds the artwork / boardgame / movie / cheese, then posts it to their preferred social network.

That's pretty simple. Perhaps too simple. You might just as well type "Mmmm, delicious Cambanzola!"

I suppose a list gives you certainty of spelling. Ideally it should also have a canonical URl to share. Other metadata (who made it, image, price, style) can wait for now.

Users

The next thing we need is a way for users to register with the platform. Or do we? What a user really wants to do is...

Check in to something.
Retrieve their previous check ins.

Things like comparing with friends, recommendations, badges, mayors, cheeses near you, they can all wait until later.

So - for our awesome alpha we want

A database of "things"
A database of "users"
A database of "user checked into this thing at this time and left this message"

My database-fu is puny, but this should be simple enough.

SHOW COLUMNS FROM things;
+------------+--------------+-----+
|   Field    |     Type     | Key |
+------------+--------------+-----+
| ID         | varchar(36)  | PRI |
| Name       | varchar(128) | UNI |
| Metadata1  | TINYTEXT     |     |
| Metadata2  | TINYTEXT     |     |
+------------+--------------+-----+

(I suppose at some point we'll want a foreign key for "Group who makes the thing" - for manufacturers and such like. But that can wait.)

Next, the users:

SHOW COLUMNS FROM users;
+------------+--------------+-----+
|   Field    |     Type     | Key |
+------------+--------------+-----+
| ID         | varchar(36)  | PRI |
| UserName   | varchar(128) | UNI |
| Metadata1  | TINYTEXT     |     |
+------------+--------------+-----+

(Again, we will probably want to store social media, email, passwords, avatar photos, in the future.)

Finally - storing the check-in themselves:

SHOW COLUMNS FROM checkins;
+---------+--------------+-----------+
|  Field  |     Type     |    Key    |
+---------+--------------+-----------+
| ID      | varchar(36)  | PRI       |
| time    | DATETIME     |           |
| userID  | varchar(36)  | users.id  |
| thingID | varchar(36)  | things.id |
| comment | TINYTEXT     |           |
+---------+--------------+-----------+

Let's Build This Thing!

CHeck-in as an Extremely Easy SErvice. Or, CHEESE for short.

Because I'm lazy, I'm going to use the Open Source HybridAuth to handle user registration. It allows people to sign in with a variety of social network logins. For the MVP, let's just use Twitter.

Creating the Databases

Using mySQL because why not. Obviously don't use password as your password. Move fast, break things.

CREATE DATABASE CHEESE;

USE CHEESE;

CREATE USER 'cheeser'@'localhost' IDENTIFIED BY 'password';
GRANT INSERT ON CHEESE . * TO 'cheeser'@'localhost';
GRANT SELECT ON CHEESE . * TO 'cheeser'@'localhost';

CREATE TABLE users(
   user_id VARCHAR(36) NOT NULL,
   twitter_username VARCHAR(128) NOT NULL,
   twitter_id VARCHAR(128) NOT NULL,
   PRIMARY KEY ( user_id )
);

CREATE TABLE cheeses(
   cheese_id VARCHAR(36) NOT NULL,
   cheese_name VARCHAR(128) NOT NULL,
   cheese_url VARCHAR(128) NOT NULL,
   PRIMARY KEY ( cheese_id )
);

CREATE TABLE checkins(
   checkin_id VARCHAR(36) NOT NULL,
   checkin_time DATETIME NOT NULL,
   user_id VARCHAR(36) NOT NULL,
   cheese_id VARCHAR(36) NOT NULL,
   comment TINYTEXT,
   PRIMARY KEY( checkin_id ),
   FOREIGN KEY( user_id ) references users( user_id ),
   FOREIGN KEY( cheese_id ) references cheeses( cheese_id )
);

Fill the Database with cheeses!

Did this manually for a dozen fromages.

INSERT into cheeses VALUES
   (UUID(), "Gorwydd Caerphilly", "https://www.thecheesesociety.co.uk/product/gorwydd-caerphilly/");

Ending up with something like this:

select * from cheeses;
+--------------------------------------+----------------------+-----------------------------------------------------------------------------------------------------+
| cheese_id                            | cheese_name          | cheese_url                                                                                          |
+--------------------------------------+----------------------+-----------------------------------------------------------------------------------------------------+
| 48695c1b-1ad5-11e7-bfe7-a417319d3fd1 | Gorwydd Caerphilly   | https://www.thecheesesociety.co.uk/product/gorwydd-caerphilly/                                      |
| b1c19c27-1ad5-11e7-bfe7-a417319d3fd1 | Isle of Mull Cheddar | http://www.internationalcheese.co.uk/products/isle-of-mull-cheddar#.WERTzHWLTcc                     |
| c17ea994-1ad5-11e7-bfe7-a417319d3fd1 | Wellesley            | http://www.hillfarmdairy.co.uk/our-cheese/                                                          |
| d080a5bc-1ad5-11e7-bfe7-a417319d3fd1 | Wigmore              | http://www.villagemaidcheese.co.uk/wigmore_main.html                                                |
| e127fe73-1ad5-11e7-bfe7-a417319d3fd1 | Rollright            | https://www.thecourtyarddairy.co.uk/shop/buy-cheese/soft-cheese-smelly-cheese/buy-rollright-cheese/ |
| ed6bf65f-1ad5-11e7-bfe7-a417319d3fd1 | Tunworth             | http://hampshirecheeses.co.uk/our-cheeses/                                                          |
+--------------------------------------+----------------------+-----------------------------------------------------------------------------------------------------+

Let users register

Again, super basic, barebones, no real UI. Visit this website, log into Twitter, get your ID registered in the users database.

    //  Setup for HybridAuth
    $config = dirname(__FILE__) . '/hybridauth-2.9.1/hybridauth/config.php';
    require_once( "hybridauth-2.9.1/hybridauth/Hybrid/Auth.php" );

    function insert($tw_name,$tw_id)
    {
        //  Connect to the Database
        $mysqli = new mysqli("localhost", "cheeser", "password", "CHEESE");
        if ($mysqli->connect_errno) {
            echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
        }

        //  Does this already exist?
        $mysqli = new mysqli("localhost", "cheeser", "password", "CHEESE");
        $stmt = $mysqli->prepare("SELECT twitter_username FROM users WHERE twitter_id = ?");
        $stmt->bind_param("s",$tw_id);
        $stmt->execute();
        $stmt->bind_result($result);
        $stmt->fetch();
        if ($result == null) {
            //  Generate a GUID for the user
            $guid = guidv4();

            $stmt = $mysqli->prepare("INSERT INTO users(user_id, twitter_username, twitter_id) VALUES (?, ?, ?)");
            $stmt->bind_param('sss', $guid, $tw_name, $tw_id);

            $stmt->execute();

        }
        /* close statement and connection */
        $stmt->close();
        /* close connection */
        $mysqli->close();
    }

    function guidv4()
    {
        //  See http://php.net/manual/en/function.com-create-guid.php
        $data = random_bytes(16);   // PHP7+ only
        assert(strlen($data) == 16);
        $data[6] = chr(ord($data[6]) & 0x0f | 0x40); // set version to 0100
        $data[8] = chr(ord($data[8]) & 0x3f | 0x80); // set bits 6-7 to 10

        //  Magic
        return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
    }


    try{
        $hybridauth = new Hybrid_Auth( $config );

        $twitter = $hybridauth->authenticate( "Twitter" );

        $user_profile = $twitter->getUserProfile();
        $tw_name = $user_profile->displayName;
        $tw_id = $user_profile->identifier;


        echo "Hi there! " . $tw_name;
        insert($tw_name,$tw_id);
        //$twitter->setUserStatus( "testing!" );

    }
    catch( Exception $e ){
        echo "Ooophs, we got an error: " . $e->getMessage();
    }

Do The Check In!

We now end up with:

select * from checkins;
+--------------------------------------+---------------------+--------------------------------------+--------------------------------------+----------------------------+
| checkin_id                           | checkin_time        | user_id                              | cheese_id                            | comment                    |
+--------------------------------------+---------------------+--------------------------------------+--------------------------------------+----------------------------+
| 02463e2b-0052-40de-a105-ab59e8e8af6c | 2017-04-06 16:15:27 | c9c6ca60-66c5-4666-a632-0efac6957ef3 | e127fe73-1ad5-11e7-bfe7-a417319d3fd1 | That rollright was lovely. |
+--------------------------------------+---------------------+--------------------------------------+--------------------------------------+----------------------------+

Post it to Twitter

That's it!

We can display a user's history, and allow them to check in to further cheeses. Lean in!

Look, there's nothing special about Check-In apps. As long as you have a fairly well sourced database of "things" you can pretty much build one in an afternoon. This was built over a couple of hours, interspersed with sampling cheese and wine. And my code quality shows!

I Would Like My One Billion Dollar Of VC Funding Now Please.

An "on this day" plugin for WordPress

@edent — Mon, 28 Nov 2016 12:35:20 +0000

Just me scratching my own itch. I want to create an RSS feed of all the blog posts which I'd published on this day in the past.

For example, if today is 21st of November 2016 then this plugin will show blog posts written on

2015-11-21
2014-11-21
2013-11-21

And so on.

You can view a demo at https://shkspr.mobi/blog/on-this-day/

Code

The code is pretty simple. The WordPress API is fairly easy to get on with.

/*
Plugin Name: OnThisDay
Description: RSS feed of posts which occurred on this day in the past
*/
//  RSS of today's historic blog posts
//  Visible at example.com/?on_this_day
add_action( 'init', 'edent_on_this_day' );
function edent_on_this_day()
{
      if( isset( $_GET['on_this_day'] ) ) {
        $today = getdate();
        $args = array(
           'date_query' => array(
              array(
                 'month' => $today['mon'],
                 'day'   => $today['mday'],
              ),
           ),
        );
        $query = new WP_Query( $args );
        rss_encode($query);
        die();
    }
}
function rss_encode($data) {
    $today = getdate();
    $pubDate =  date("D, d M Y") . " 00:00:00 GMT";
    $rss = '<'.'?xml version="1.0" encoding="UTF-8" ?>
            
            
                   On This Day
                   
                   ' . site_url() . '/?on_this_day
                   en-gb';
    $posts = $data->get_posts();
    foreach($posts as $post) {
        // Do your stuff, e.g.
        $title= $post->post_title;
        $id  = $post->ID;
        $link = get_permalink($id);
        $date = $post->post_date;
        $postDate = date("D, d M Y") . " " . date("h:i:s O", strtotime($date));
        $thumb = get_the_post_thumbnail($id, 'full');
        $archive = "From the " . date("F Y", strtotime($date)) . " archives: ";
        //  Only add an item if it is before *this year*
        //  AND before the current hour (prevents suddenly adding loads of posts)
        if (
              ( intval(date("Y", strtotime($date))) <  intval($today['year'] ) ) &&
              ( intval(date("H", strtotime($date))) <= intval($today['hours']) )
        ) {
                $rss .= '
                   '  .html_entity_decode($archive . $title).'
                   '   .htmlspecialchars($link).'
                   
                      
                   
                   '.$postDate.'
                   '   .htmlspecialchars($link).'
                ';
        }
    }
    $rss .= '
    ';
    header('Content-Type: application/rss+xml');
    echo $rss;
}

The latest versions of the source code is at https://github.com/edent/WordPress-On-This-Day-Plugin

Limitations

Times

The entries in the RSS feed are generated on an hourly basis.

For example, if the time is 1300 the RSS feed will only show blog posts published on or before 1300 on their original publication day.

This allows services like IFTTT to post the feed to Twitter throughout the day rather than all at once.

Location

This plugin lives at https://example.com/?on_this_day. The results are not cached.

Images

The thumbnail from the post is also included. If there is no thumbnail, services like IFTTT might misbehave:

Times and Locale

The RSS feed is hardcoded to GMT and en-GB - this may change in the future.

Posting

I'm using IFTTT to post to Twitter. Ideally, I'd use JetPack Publicize to syndicate it to Facebook, LinkedIn, and others.

Using

I'm not releasing this into the WordPress plugin ecosystem because their system confuses me. You can install it in /wp-content/plugins/onthisday/ and then activate it as normal.

You can download the plugin from GitHub

The (Connected) House Of Horrors

@edent — Wed, 09 Nov 2016 12:07:19 +0000

In September 2016, I was delighted to deliver this talk to ThingMonk 2016.

This is the 20 minute distilation of my adventures Singing to my lightbulbs, hacking my vacuum cleaner, finding my car's source code, hacking my electric car, getting hacked by my light switches, securing my security cameras, and a whole host of other IoT nonsense.

Huge thanks to Bennycrime for filming, and the whole ThingMonk team.

If you'd like me to speak at your conference, please get in touch.

A selection of comments about the talk as I gave it.

Reverse Engineering the Renault Zoe API

@edent — Sun, 16 Oct 2016 10:46:28 +0000

Last year I published details of the BMW i3's API. I've now swapped my i3 for a Renault Zoe - so I thought I'd perform the same exercise.

All these API calls can be found by using the Renault ZE Services website. I am indebted to this German blog post for kicking off this work. I'd also like to thank Renault for their "esoteric" use of JavaScript!

What's Available?

This API is fairly limited, here's what you can do with it:

See battery status, range, charging status.
Start preconditioning
See preconditioning history
See and set charging schedule.
See charging history

Getting started

First, register with Renault ZE Services. This will give you a username and password.

Secondly, you'll need to get your VIN and API token. This can be obtained by posting the username and password to Renault. For example:

curl \
   -H "Content-Type: application/json" \
   -X POST \
   -d '{"username":"you@example.com","password":"P4ssw0rd"}' \
   https://www.services.renault-ze.com/api/user/login`

This will get you back some JSON with your API tokens. Here's an example:

{
    "token": "AAAA",
    "refresh_token": "BBBB",
    "user": {
        "id": "CCCC",
        "locale": "en_GB",
        "country": "GB",
        "timezone": "Europe/London",
        "email": "you@example.com",
        "first_name": "Terence",
        "last_name": "Eden",
        "phone_number": "+447700900123",
        "vehicle_details": {
            "timezone": "Europe/London",
            "VIN": "VVVV",
            "activation_code": "GGGG",
            "phone_number": "+447700900123"
        },
        "scopes": ["BATTERY_CHARGE_STATUS",
                   "BATTERY_CHARGE_HISTORY",
                   "BATTERY_CHARGE_REMOTE_ACTIVATION",
                   "BATTERY_CHARGE_SCHEDULING",
                   "AC_REMOTE_CONTROL",
                   "BATTERY_CHARGE_LOWALERT"],
        "active_account": "DDDD",
        "associated_vehicles": [{
            "VIN": "VVVV",
            "activation_code": "GGGG",
            "user_id": "XXXX"
        }],
        "gdc_uid": "YYYY"
    }
}

Battery Status

Let's start with the battery. We need to use your token and VIN from above.

curl \
   -H "Authorization: Bearer AAAA" \
   "https://www.services.renault-ze.com/api/vehicle/VVVV/battery"

This gets us:

{
    "charging": false,
    "plugged": true,
    "charge_level": 100,
    "remaining_range": 124.0,
    "last_update": 1476472742000,
    "charging_point": "INVALID"
}

A few point to note. The remaining_range is in Kilometres. The last_update is a Unix timestamp.

Preconditioning

The Zoe can be set to warm-up or cool down depending on the last temperate you set in the car. It will also blast the front window de-mister. The process takes five minutes, so you can set it shortly before you need to set off. Preconditioning will only work when the car's battery is above 45%.

Precondition Now

curl \
   -H "Authorization: Bearer AAAA" \
   "https://www.services.renault-ze.com/api/vehicle/VVVV/air-conditioning"

This command does not return any value. There is also no way to cancel the command remotely - you have to physically enter the car and turn it off.

Precondition Later

If you know that you want to leave at a specific time, you can set the car to precondition at a set time.

curl \
   -H "Authorization: Bearer AAAA" \
   -H 'Content-Type: application/json;charset=UTF-8' \
   --data-binary '{"start":"1753"}' \
   'https://www.services.renault-ze.com/api/vehicle/VVVV/air-conditioning/scheduler'

As far as I can tell, the start time is when you want the conditioning to start - not when you want it to be finished.

There is no way to cancel a precondition.

Preconditioning Last Status

Want to see if the preconditioning message was received by the car correctly?

curl \
   -H "Authorization: Bearer AAAA" \
   "https://www.services.renault-ze.com/api/vehicle/VVVV/air-conditioning/last"

This returns information about who or what sent the request:

{
    "date": 1476538293000,
    "type": "USER_REQUEST",
    "result": "SUCCESS"
}

Preconditioning History

You can also see how often your car has been preconditioned.

curl \
   -H "Authorization: Bearer AAAA" \
   https://www.services.renault-ze.com/api/vehicle/VVVV/air-conditioning?begin=1016&end=1016

[{
    "date": 1476165377000,
    "type": "USER_REQUEST",
    "result": "ERROR"
}, {
    "date": 1476079325000,
    "type": "CAR_NOTIFICATION",
    "result": "ERROR"
}, {
    "date": 1476079270000,
    "type": "USER_REQUEST",
    "result": "SUCCESS"
}, {
    "date": 1476079266000,
    "type": "CAR_NOTIFICATION",
    "result": "SUCCESS"
}]

Start Charging

You may have set your Zoe only to charge at specific times - perhaps to take advantage of cheap rate electricity. You can override this by issuing the charge command.

curl \
   -H "Authorization: Bearer AAAA" \
   https://www.services.renault-ze.com/api/vehicle/VVVV/charge

Again, this won't return a response. If your battery cannot be charged, you'll be notified via email or SMS depending on the preference you set up when you registered.

Charging History

curl \
   -H "Authorization: Bearer AAAA" \
   https://www.services.renault-ze.com/api/vehicle/VVVV/charge/history?begin=1016&end=1016

The begin and end take MMYY as their arguments. That is, if you want October 2016 you need to use 1016.

This returns an array, the most recent charging session at the top.

[{
    "date": 1476538527000,
    "type": "START_NOTIFICATION",
    "charging_point": "SLOW",
    "charge_level": 99,
    "remaining_autonomy": 119
}, {
    "date": 1476472727000,
    "type": "END_NOTIFICATION",
    "charging_point": "INVALID",
    "charge_level": 100,
    "remaining_autonomy": 124
}, {
    "date": 1476462129000,
    "type": "START_NOTIFICATION",
    "charging_point": "ACCELERATED",
    "charge_level": 34,
    "remaining_autonomy": 42,
    "remaining_time": 10500000
}]

The remaining_autonomy is, again, the range in Km. The remaining time is expressed in milliseconds. So 10500000 is the equivalent of 2 hours and 55 minutes.

Notifications

You can use the website to set up notifications. For example, if there is a problem with your charge, Renault will send you an SMS. This API call lets you see what notifications you have set up.

Set Notifications

curl \
   -H "Authorization: Bearer AAAA" \
   -X PUT \
   -H 'Content-Type: application/json;charset=UTF-8' \
   --data-binary '{"battery_status":"EMAIL","charge_start":"SMS","charge_end":"SMS","charge_problem":"SMS","low_battery":"SMS","low_battery_reminder":"SMS","do_not_disturb":null}' \
   'https://www.services.renault-ze.com/api/vehicle/VVVV/settings/notification'

You can change any of the options with EMAIL or SMS.

You can set a "do not disturb" option. This will suppress all notifications during specific times. Sadly, this is a fairly blunt instrument - you can only set one time which then is enforced every day.

In the above example, change "do_not_disturb":null to

"do_not_disturb":{"start":"1710","end":"1811"}}'

This will give you peace between 5:10pm and 6:11pm.

See Notifications

You can use the website to set up notifications. For example, if there is a problem with your charge, Renault will send you an SMS. This API call lets you see what notifications you have set up.

curl \
   -H "Authorization: Bearer AAAA" \
   https://www.services.renault-ze.com/api/vehicle/VVVV/settings/notification

This returns:

{
    "battery_status": "EMAIL",
    "charge_start": "NONE",
    "charge_end": "SMS",
    "charge_problem": "SMS",
    "low_battery": "SMS",
    "low_battery_reminder": "SMS",
    "do_not_disturb": null
}

Charging Times

The Zoe's charging calendar is, sadly, crap. You can say "charge between these times" but you can only have one schedule per day. So if you only want the car to charge between 0300-0700 and 1800-2200 on Mondays - you're out of luck.

It also seemed to force me to set a schedule for every day.

This is a multi-stage process.

Create a schedule

In this example, I'm setting the charging to be active on Monday from 0100 for 1 hour and 15 minutes. All other days start at different times, but last only for 15 minutes. All start times must be at 00, 15, 30, 45 minutes. All durations must be in increments of 15 minutes.

curl \
   -H 'Authorization: Bearer AAAA' \
   -X PUT \
   --data-binary '{"optimized_charge":false,"mon":{"start":"0100","duration":"0115"},"tue":{"start":"0200","duration":"0015"},"wed":{"start":"0300","duration":"0015"},"thu":{"start":"1600","duration":"0015"},"fri":{"start":"1900","duration":"0015"},"sat":{"start":"1400","duration":"0015"},"sun":{"start":"1200","duration":"0015"}}' \
   'https://www.services.renault-ze.com/api/vehicle/VVVV/charge/scheduler/offboard'

View the schedule

Let's make sure the schedule has been sent correctly

curl \
   -H 'Authorization: Bearer AAAA' \
   'https://www.services.renault-ze.com/api/vehicle/VVVV/charge/scheduler/onboard'

Returned - hopefully! - is the schedule:

{
    "enabled": false,
    "schedule": {
        "mon": {
            "start": "0100",
            "duration": "0115"
        },
        "tue": {
            "start": "0200",
            "duration": "0015"
        },
        "wed": {
            "start": "0300",
            "duration": "0015"
        },
        "thu": {
            "start": "1600",
            "duration": "0015"
        },
        "fri": {
            "start": "1900",
            "duration": "0015"
        },
        "sat": {
            "start": "1400",
            "duration": "0015"
        },
        "sun": {
            "start": "1200",
            "duration": "0015"
        }
    }
}

Deploy the schedule

Be default, the schedule isn't activated. It needs to be "deployed" in order to send it to the car.

curl \
   -H 'Authorization: Bearer AAAA' \
   -X POST \
   'https://www.services.renault-ze.com/api/vehicle/VVVV/charge/scheduler/offboard/deploy'

Deactivate the schedule

If you deactivate the schedule then the car will charge whenever it is plugged in.

curl \
   -H 'Authorization: Bearer AAAA' \
   -X PUT \
   --data-binary '{"enabled":false}' \
   'https://www.services.renault-ze.com/api/vehicle/VVVV/charge/scheduler/onboard'

That's all folks?

There are a few other API calls - mostly around registering and removing vehicles, and updating personal details. I've not detailed these because I didn't want to test them with my live account.

What's Missing?

Sadly, the Renault API is quite poor compared to BMW's API. Here's what I'd love to see:

Vehicle status - doors locked, headlights on.
Efficiency - last journey, total.
Mileage.
Physical location.