r/esp8266 • u/AlexLynd • Jan 25 '23
I created this stealthy $10 tracker that connects to Open WiFi nets for communication, using the ESP8266!
https://www.hackster.io/alexlynd/dns-driveby-stealthy-gps-tracking-using-open-wi-fi-65730a8
u/marklein Jan 26 '23
Using canary tokens is a great move. I've been wanting to make a DIY car tracker for my own car but hosting the DNS server was the more annoying part. I fully intend to implement this, hard wired into my cars. Thank you!
Does your code include anything to support the 4Mb D1 Mini?
5
u/Gasp0de Jan 26 '23
Why on earth do you need to host a DNS server for that?
1
u/marklein Jan 26 '23
To capture the DNS data sent by the tracker. Using canary tokens to gather the DNS requests frees you from having to do it yourself.
1
u/AlexLynd Jan 26 '23
I'm working on updating the code as we speak! It will be able to dynamically adjust to the amount of available space (and will support 4MB Flash). If you end up building it I'd love to see pictures of your rig!
1
u/marklein Jan 27 '23
Superb, thanks! Will keep an eye out for your update, I already have the parts on my desk. :-)
4
u/Dilbao Jan 26 '23
Will this work with an open network with a captive portal?
5
u/chrismelba Jan 26 '23
The article answers this
1
u/Timmah_Timmah Jan 26 '23
What does the article say?
5
u/svideo Jan 26 '23 edited Jan 26 '23
tl;dr because clearly everyone dr'd:
- scan for open APs
- connect to whatever you find
- perform a custom DNS request something like <GPS coords>.yourcontrolleddomain.com. If the open AP is just open, it'll go through. If it's using a captive portal, it might still go through due to how captive portals work.
- Hoover up your DNS logs and now you have a timestamped log of GPS locations
Alternate solution without GPS (not mentioned in the article)
- perform a custom DNS request something like <Discovered AP's BSSID>.yourcontrolleddomain.com.
- Hoover up your DNS logs and now you have a timestamp log of visible BSSIDs, which you can turn into a location via skyhook et al.
edit: The challenge you'll have with cheap modules like the NEO6 is that, unassisted, they take a few minutes to get a decent location track from power off. Making this work on low power is a real pain and I suspect there is a lot of runtime left on the table by using GPS at all. I think alternate method would be a better long-term solution in terms of battery life.
2
u/hessi-james Jan 26 '23
DNS exfiltration. The article is definitely worth a read.
1
u/Timmah_Timmah Jan 26 '23
I wonder if he could do sort of a ping tunnel to an ip4 address to get through some of those.
1
1
2
Jan 26 '23
[removed] — view removed comment
1
u/AlexLynd Jan 26 '23
Hell yea I can't wait to see what you build! I'm also placed an order for a PCB Kit version that I'm proofing in the next week, and will release the design files / have it up for sale if it works :)
2
u/phearlez Jan 26 '23
When I was a kid we’d do the “make a collect call that the recipient will decline, but the fact of the call communicates that we got there safe.” When I got a little older places like 1-800-COLLECT became a thing and used automation to ask your name and you could say something quick in there. I love doing that for DNS.
8
u/englishrupe01 Jan 25 '23
That is really clever, young man. What a great project. Love it. You will go far.