Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
.. image:: https://raw.githubusercontent.com/Nekmo/amazon-dash/master/amazon-dash.png :width: 100%
|
.. image:: https://img.shields.io/travis/Nekmo/amazon-dash/develop.svg?style=flat-square&maxAge=2592000 :target: https://travis-ci.org/Nekmo/amazon-dash :alt: Latest Travis CI build status
.. image:: https://img.shields.io/pypi/v/amazon-dash.svg?style=flat-square :target: https://pypi.org/project/amazon-dash/ :alt: Latest PyPI version
.. image:: https://img.shields.io/pypi/pyversions/amazon-dash.svg?style=flat-square :target: https://pypi.org/project/amazon-dash/ :alt: Python versions
.. image:: https://img.shields.io/codeclimate/github/Nekmo/amazon-dash.svg?style=flat-square :target: https://codeclimate.com/github/Nekmo/amazon-dash :alt: Code Climate
.. image:: https://img.shields.io/codecov/c/github/Nekmo/amazon-dash/master.svg?style=flat-square :target: https://codecov.io/github/Nekmo/amazon-dash :alt: Test coverage
.. image:: https://img.shields.io/requires/github/Nekmo/amazon-dash.svg?style=flat-square :target: https://requires.io/github/Nekmo/amazon-dash/requirements/?branch=master :alt: Requirements Status
Amazon-dash is still alive ########################## Amazon has abandoned the Amazon-dash buttons, but this project wants to keep them alive. However, we are looking for alternatives. If you have suggestions you are welcome to open an incident. All suggestions are welcome. You can open an issue with your suggestions.
Python Amazon Dash ################## Hack your Amazon Dash to run what you want. Without welders. For the entire family.
This program written in Python runs in daemon mode waiting for someone in the same network to press a configured Amazon Dash button. It is not necessary to know programming to use this program. Amazon-Dash executes commands by command line, calls a url and more. This program works well on a Raspberry PI or on computers with few resources.
.. code:: console
$ sudo pip3 install amazon-dash # and after:
$ sudo python3 -m amazon_dash.install
Also available on AUR <https://aur.archlinux.org/packages/amazon-dash-git/>
_ and
FreeNAS <http://docs.nekmo.org/amazon-dash/installation.html#freenas>
. You can also use pip2
and
python2
if your system only has Python2, but Python 3 is the recommended version. See other installation
methods in the documentation <http://docs.nekmo.org/amazon-dash/installation.html>
.
Note: It may also be necessary to install tcpdump
on your system (in Debian apt install tcpdump
).
.. code-block:: console
$ sudo amazon-dash discovery
3. Edit config file (/etc/amazon-dash.yml
):
.. code-block:: yaml
# amazon-dash.yml
# ---------------
settings:
delay: 10
devices:
0C:47:C9:98:4A:12: # Command example
name: Hero
user: nekmo
cmd: spotify
AC:63:BE:75:1B:6F: # SSH example
name: Tassimo
cmd: door --open
ssh: 192.168.1.23:2222
AC:63:BE:67:B2:F1: # Url Webhook example
name: Kit Kat
url: 'http://domain.com/path/to/webhook'
method: post
content-type: json
body: '{"mac": "AC:63:BE:67:B2:F1", "action": "toggleLight"}'
confirmation: send-tg
40:B4:CD:67:A2:E1: # Home Assistant example
name: Fairy
homeassistant: hassio.local
event: toggle_kitchen_light
18:74:2E:87:01:F2: # OpenHAB example
name: Doritos
openhab: 192.168.1.140
item: open_door
state: "ON"
confirmation: send-pb
44:65:0D:75:A7:B2: # IFTTT example
name: Pompadour
ifttt: cdxxx-_gEJ3wdU04yyyzzz
event: pompadour_button
data: {"value1": "Pompadour button"}
confirmations:
send-tg:
service: telegram
token: '402642618:QwGDgiKE3LqdkNAtBkq0UEeBoDdpZYw8b4h'
to: 24291592
is_default: false
send-pb:
service: pushbullet
token: 'o.BbbPYjJizbPr2gSWgXGmqNTt6T9Rew51'
is_default: false
UPGRADE from previous versions <http://docs.nekmo.org/amazon-dash/installation.html>
_
The following execution methods are supported with your Amazon Dash button with this program:
================================ ================================ ================================
.. image:: https://goo.gl/VqgMZJ .. image:: https://goo.gl/a6TS7X .. image:: https://goo.gl/zrjisq
System command
_ Call url
_ Homeassistant
_
.. image:: https://goo.gl/Cq4bYC .. image:: https://goo.gl/L7ng8k
OpenHAB
_ IFTTT
_
================================ ================================ ================================
Amazon-dash also allows you to send a confirmation after pressing a button. You will also receive a message in case of failure. Telegram and Pushbullet are supported.
For more information see
the documentation of the configuration file <http://docs.nekmo.org/amazon-dash/config_file.html>
_.
If you use a Systemd system (Debian 8+, Fedora 15+, Ubuntu 15.04+, Arch Linux 2012+, OpenSUSE 12.1+, and more) execute:
.. code-block:: console
$ sudo systemctl start amazon-dash
To run Amazon-dash at startup:
.. code-block:: console
$ sudo systemctl enable amazon-dash
To run Amazon-dash manually look at the documentation <http://docs.nekmo.org/amazon-dash/usage.html>
_.
December 31 is the last day to block requests from your Amazon-dash buttons to Amazon servers. In 2020 your buttons
can be bricked in an update from Amazon servers. To continue using your buttons you must configure your router
to block Internet connections from the buttons. Alternatively you can block these domains: dash-button-na-aws-opf .amazon.com
, 0.amazon.pool.ntp.org
, 1.amazon.pool.ntp.org
, 2.amazon.pool.ntp.org
, 3.amazon.pool.ntp .org
. However, it is recommended to block all requests from the buttons.
Using Amazon Dash within docker is easy! First, pull the Docker image:
.. code-block:: console
$ docker pull nekmo/amazon-dash:latest
Then, create a container and run Amazon Dash itself:
.. code-block:: console
$ docker run -it --network=host \
-v </full/path/path/to/amazon-dash.yml>:/config/amazon-dash.yml \
nekmo/amazon-dash:latest \
amazon-dash run --ignore-perms --root-allowed \
--config /config/amazon-dash.yml
Do you need ideas on how to use Amazon Dash? See what the community does with this project. Some examples:
The Simpsons Random Episode <http://docs.nekmo.org/amazon-dash/community.html#the-simpsons-random-episode>
_Shopping list in Google Keep <http://docs.nekmo.org/amazon-dash/community.html#shopping-list-in-google-keep>
_Play a audio <http://docs.nekmo.org/amazon-dash/community.html#play-a-audio>
_See all the examples in the community
_.
.. _System command: http://docs.nekmo.org/amazon-dash/config_file.html#execute-cmd .. _Call url: http://docs.nekmo.org/amazon-dash/config_file.html#call-url .. _Homeassistant: http://docs.nekmo.org/amazon-dash/config_file.html#homeassistant-event .. _OpenHAB: http://docs.nekmo.org/amazon-dash/config_file.html#openhab-event .. _IFTTT: http://docs.nekmo.org/amazon-dash/config_file.html#ifttt-event .. _in the community: http://docs.nekmo.org/amazon-dash/community.html
FAQs
Hack your Amazon Dash to run what you want.
We found that amazon-dash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.