I got a Greenlite AIRZ thermostat which connects to my home wifi so that I can change the settings remotely on my phone. The Android app is, however, difficult to use, so I'm thinking about making my own. I found its IP address, put it in a browser, and it said verbatim File / not_found. The thermostat also rejects my request to connect to port 21/22. How should I proceed from here? Is the underscore between not and found a quirk of a specific server that would allow me to probe further?
-
This is not really about information security. If you are trying to reverse engineer how the device works better ask at Reverse Engineering.– Steffen UllrichCommented Sep 12, 2020 at 5:49
-
Without more specific details, I think this question boils down to "how to reverse engineer this system" which is probably better answered in book format. That said, you could be on the right track using those artifacts to learn more about the system.– multithr3at3dCommented Sep 12, 2020 at 16:53
-
1Good start point would be decompiling the android application and checking how does it perform settings change– morsiskoCommented Sep 12, 2020 at 18:29
Add a comment
|
3 Answers
The best approach here would be to look at the App, that way you know exactly what to send (especially when they add some encryption or signing). The second best option would be to look at the network traffic and hope that it's easy to figure out how it works from that. If that also doesn't work the last option in my opinion would be to attack the device itself: As mentioned in other responses you are looking for UART, JTAG or other debug ports. Also you can look for SPI Flashes, NAND Flashes, eMMC Memory and read those out then. But this is the most difficult method which should only be followed when the other methods don't work or you have a good reason to do so (to discover "secret" functionality for example).
You have to debug its hardware.
Search for its serial port. Look into UART. https://www.societyofrobots.com/microcontroller_uart.shtml
You have to do a boundary scan, and figure out its hardware boundries. You can do that through JTAG https://www.jtag.com/boundary-scan/
-
1The JTAG recommendation should come with a huge disclaimer.– 0xC0000022L ♦Commented Feb 23, 2021 at 10:01
I do agree with Richi's answer.
You've got three ways to do it:
- The simplest method would be to sniff the traffic of the Android App, try to see the commands sent and state received from the device (if any). You may want to bypass SSL Pinning if any does exist.
- The second method would be to reverse engineer the existing Android App, and try to extract the API authentication/credentials, endpoints and communication data.
- The third overkill method would be to go for the device itself.
- In case you don't want to touch the hardware, maybe a simpler approach would be to look for a config backup/firmware from the device's official website, and try to extract the file system and analyze the apps/scripts that execute at the OS startup. That would be way harder if the binary was compressed/encrypted somehow.
