While it's a cool result, I think the security of this is really lacking. The author mentions to not want to expose the Rasperry Pi to the internet due to security reasons, but then does so anyway through a reverse proxy, which doesn't even add any authentication.

To exploit this, you can simply do: 1. Search in AWS networks for open ports 6000. Tools like masscan help, but if you give it time it will also show up on shodan.io 2. Connect and send a GET request to the /switch/on path and check if you get a 200.

This project has been around awhile:

https://www.lirc.org/