ESP-Watchtower turns a $3 ESP8266 into a home-network tripwire with a fake Telnet shell, a fake router login and a fake security camera

The README calls them “3 Armed Burglar Traps.” Door 1 answers Telnet with a real-looking banner, “Ubuntu 22.04.4 LTS,” then asks for a login and a password, writes both down and replies “Login incorrect.” Door 2 serves a router sign-in page and logs what gets typed into it. Door 3 pretends to be an IP camera and turns every visitor away with an RTSP “401 Unauthorized,” after noting their address.

Abhishek Prasad put it on GitHub on October 25 under the MIT license. The hardware is a NodeMCU or WeMos D1 Mini that costs “~$2.50 – $4.00 USD” and runs off any phone charger at “less than 0.5 Watts.”

The traps are the fun part, and there’s more on the board. It pings your router and 1.1.1.1 to track lag, packet loss and outages, notices when the power drops and for how long, sends Wake-on-LAN packets to sleeping PCs, and posts a morning report to a Discord channel. Logs go to the chip’s flash in /audit.log, so “no evidence is lost during power loss.”

The reason a decoy works at home is simple: no printer, TV or laptop in the house has any business logging into a fake camera. The same idea runs Thinkst’s OpenCanary, “a multi-protocol network honeypot” that sends alerts “when attackers breach networks and interact with the honeypot.” ESP-Watchtower shrinks it to a board the size of a stick of gum.

Telnet is a sensible door to fake. When the Mirai botnet spread through “vulnerable IoT devices,” it logged in with “a fixed set of 64 well-known default login/password combinations,” Elie Bursztein wrote in a retrospective on the Cloudflare blog, and “by its second day, Mirai already accounted for half of all Internet telnet scans.”

The setup network is where the trap needs a lock of its own. Fresh off the flasher, the board opens a Wi-Fi network called ESP-Watchtower with the password sentinel123, printed in the README. The code also brings that same network back whenever the board can’t reach your home Wi-Fi at startup, as after a power cut where the board boots faster than the router.

The dashboard on port 80 has no login either. Reading the firmware, the handlers behind its API answer anyone who can reach the board. One of them, /api/clear-logs, deletes /audit.log and logs the wipe as “Activity records cleared by owner.” Anything on your network that finds the dashboard can erase the record the traps just wrote, and another endpoint changes which Wi-Fi network the board joins.

The traps already work, so the open question is the lock. A pull request that puts the dashboard and its delete button behind a password, and lets you change sentinel123 from the setup page, would make this the easiest home honeypot to recommend.