Day-1 with a TTIG-868
summary
Teardown and 10-hour audit of a €70–85 TTIG-868 finds an ESP8266 main board with disabled USB but recoverable UART after reworking resistors, an SX1308 LoRa module, and an exposed SPI flash that resists dumping until SPI pull resistors are fixed. Device runs Semtech basic station JSON LNS/CUPS over TLS with unique printed WPA2 password, only port 80 for local UI, optional “no auth” mode, credentials stored as files (deleting them disables auth), firmware source on GitHub, no obvious buffer overflows, reset wipes user data.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 1:40Security is expensive
- 2:00IOT security requirements
- 3:32Equipment
- 4:57Device
- 6:27Laura Bond
- 8:04Device Info
- 9:00Basic Interface
- 9:11Input Field
- 9:38Input Validation
- 10:02Port Scan
- 10:40Basic Station Concepts
- 11:49Configuration Update Server
- 13:13Security Authentication
- 16:00LNS
- 18:10Basic setup
- 21:16SSL redirect
- 22:43Quick teardown
- 23:15ESP8266
- 24:47System Configuration
- 25:38USB Chip
- 27:08Flash Memory
- 28:30Resistor
- 28:56Spy
- 29:40Marshall Apps
- 31:03Analysis
- 32:10Quick Verdict
- 33:49Backend
- 35:01Summary
- 36:31Outlook
- 37:23Questions
related talks
36mWorkshop: Wireless made FUN
29mWorkshop: The new STM32 System on Chip
24mLITE Lightning Talks
01h 06mWorkshop: An end to end integration of a LoRaWAN sensor
52mIoT Hacking 101: Reverse Engineering The Xiaomi Ecosystem
18mTinySDR: Low Power SDR Platform for Over the Air Programmable IoT Testbeds
50mPrototyping New Ideas with the ESP32 and Azure
19mUsing Javascript for IoT Internet of Tums