Kevin Chung Reverse Engineered NYCTrainSign and Their API After the IoT Company Vanished

Hacker and chess player Kevin Chung reverse engineered the code and API that drove an LED matrix from a company called NYCTrainSign. Unfortunately, the company behind the internet-connected LED signs faded away five years ago. This loss meant that anyone with one had an LED brick. But, thanks to Chung's efforts, existing signs are functional again (and you could build your own.)

NYCTrainSigns look like the signs used in a metro train system. They have a matrix of RGB LEDs in a wooden enclosure. People could place them on their desks, bookshelves, or the wall. The sign's messages came from a remote site via a proprietary API.

Chung tore down one of the original products and found an unreasonably high bill of materials (BOM) cost. The signs consist of off-the-shelf modules more appropriate for prototypes. For example, NYCTrainSign built the signs with an actual Raspberry Pi instead of using a custom microcontroller board. As a result, the high BOM cost led to a high retail price that did not align with the build quality (or reliability.)

While inspecting the Raspberry Pi powering the signs, Chung noticed the original git history was on the SD Card! This discovery enabled him to reverse engineer the API and create an exploit that jailbreaks the device.

Originally the signs connected to the domain "trainsignapi.com." Since the company vanished and let the domain lapse, Chung registered it. Now there is a new web portal with instructions for existing users on how to reconnect their sign using the new, open sourced API.

Not only can existing users benefit from Chung's work, but potentially new users as well! Between the open sourced API, the release of the Pi contents, and most of the hardware being off-the-shelf, anyone can build an NYCTrainSign.

Check out Chung's full write-up for a brief history of the company, his findings, and links to the (new) resources.