1

I want to develop a web-based API in Rails for some LockState wifi programmable thermostats, so that other different application can control these thermostats. But I'm cannot find any resource about how these thermostats are accessible from the Internet and how to connect to these thermostats. Is there any documentation available? If not, how would I find how to interact with the thermostats?

  • 2
    So you want to reverse engineer the API that is apparently used by some proprietary application? Do you have the proprietary application? Do you have one of the thermostats? – 0xC0000022L May 2 '13 at 11:57
  • 1
    Given that you could answer @0xC0000022L's question with a yes, the next step would be using a traffic sniffer (e.g. wireshark) or logging proxy (e.g. Charles) for gathering information on the control requests and their answers. – Till May 2 '13 at 12:28
  • yes, I have one. – rony36 May 2 '13 at 12:41
5

Okay, so far your question is a bit meager on the informational side, but it's intriguing. Let me start an attempt to answer it. I'll not be able to answer it, lacking the device in question.

Methodology

Here's what I would do.

  1. Pose as a WiFi access point (AP). Most WiFi cards will allow you to do this, if the software side allows for it as well. If the existing access point is something like a Linux-based access point, you don't need anything else.
  2. Once you are the AP sniff the traffic that goes through the interface using Wireshark, tcpdump or similar tools.
    1. Figure out the protocol used
      • if it's a plain text protocol you are only left with decoding the meaning of the sent data
      • if it is encrypted
        1. see whether you can use a man-in-the-middle attack to read the data stream
        2. try to find out the version of the server software. Usually embedded software is lagging behind a bit, so if you find it is vulnerable, you may be able to get a (root) shell.
        3. try to find firmware updates for the device and see whether tools like binwalk and firmware-mod-kit can make sense of them. Being able to unpack the firmware updates will give you a lot of information about the device and what's running on the current version, even if the versions may differ.
      • if you find out that particular certificates are allowed and they are based based on a weak hash algorithm (MD5) or if it happens to be an SSH key created on Debian while it was vulnerable. In the former case you may be able to forge a certificate and in the latter you will be able to brute-force an otherwise secure SSH connection
  3. Failing all of the above and being able (financially) to sacrifice one of the devices, I'd take it apart and try to find whether I can get a serial console or whether JTAG pins/contacts are available. If I was able to find out more about the used chips, I'd give boundary scanning a try.

The further down you were reading the more hurdles to take and the harder the approach. Now, perhaps you edit more details into your question if this partial answer gets you started.

  • great answer - I would never have thought about possible SSH usage etc. not to mention on how to tackle that. Still my guess (and it really is just a guess!) is that the traffic/API will be plain HTTP based, JSON formatted REST stuff. – Till May 5 '13 at 1:05
  • @Till: likely indeed. But without further input from the OP we won't be able to give anything but an outline of a generic approach as I did. Oh well :) – 0xC0000022L May 5 '13 at 1:11
2

This thermostat looks identical to the Radio Thermostat CT-50. That device has an open JSON API which you can read on their website. http://radiothermostat.com

| improve this answer | |
  • Please add some of the relevant information into the answer itself. Link only posts are not considered answers. – asheeshr Jun 28 '13 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.