"We can't send plaintext over the air, it's unsafe" "Don't worry I've added AES encryption"
Encryption against air I suppose
I bricked my Christmas lights
41–50 of 85 posts
Re: I bricked my Christmas lights
#42Nice writeup! It reminded me of trying to reverse engineer some lights I have, only to discover they’re encrypted. One is an amaran 60d and then the rest are a handful of SmallRig RM75 battery LED lights, and I wanted to make a script to turn them all on/off instead of fiddling with 2 separate apps.
I spent a bunch of time trying to reverse engineer the apps and the protocol, and it turns out both of these lights seem to use the same negotiation process but use different libraries to do it. I tried to mimic the Diffie-Hellman key exchange process they do on connection, and then kinda gave up. IIRC there was another step or 2 after that, one where it sent a random-looking number (another key? After sending the first key??) and I couldn’t figure out what it wanted there.
Your writeup makes me think I should just go try that hardcoded key and see if it works…
Re: I bricked my Christmas lights
#43It goes up to eleven
[deleted]
Re: I bricked my Christmas lights
#44Re: I bricked my Christmas lights
#45"We can't send plaintext over the air, it's unsafe" "Don't worry I've added AES encryption"
Tuya is so hilarious in this regard. The protocol is just TLS over TCP, but the app happily sprays your Wi-Fi password to every STA in the area every time you add a new device.
(It's how pairing is done - the app blindly broadcasts packets to 255.255.255.255 and the target device (lightbulb, power outlet, et al) just sits in promiscuous mode. The packet contents are protected by WPA2 et al, but the packet lengths aren't, so the protocol sends a bajillion tiny packets with each packet's length set to the ASCII byte value of the next character in the setup handshake. I believe it sends it multiple times in a row. This is why pairing takes 2 minutes then always abruptly stops before the counter reaches zero.)
\o/
Re: I bricked my Christmas lights
#46I'm looking for some flexible, robust lights for my car's roof rack. I'm wondering if anyone knows a set that will fit these requirements: - Battery powered and outdoor / all weather compatible - Easy to attach the battery box to surfaces using ties - Ideally "mini" form factor ("T5") [1] - Ideally RGB and programmable. I'd like to use them for Christmas (red/green), Halloween (purple/orange), and other seasons. Does…
You can check out "bullet string" style WS2811s. They're 12v native if you're tying back to your car's 12v, usually come waterproof with xConnect pigtails, and are very attachable/flexible. They're easy to resolder with extensions and chain too: https://www.aliexpress.com/item/4000105913323.html From what I've ready, they or similar 5V lights seem standard in outdoor Christmas lighting for shows.
12V is used more often than 5V for outdoor shows. This vendor is very popular, and also has a discussion about 12V vs. 5V: https://www.holidaycoro.com/kb_results.asp?ID=126
Also, the xConnect pigtails are great for wiring up large shows and for adding longer run extension cables.
Re: I bricked my Christmas lights
#47Beginners question, is there a reason we can’t reverse engineer something similar for lights made by Govee? Is it because it’s WiFi and harder to MITM?
There are a few projects on github for govee lights. On windows I have used https://github.com/ib0b/RGB-PC to connect to mine by bluetooth but the problem is that govee lights can only be connected to one bluetooth device at a time
Re: I bricked my Christmas lights
#48I've read enough... A set of lights with BLE, I'm out. Thanks to the author for referencing them.
It did remind me of the analog Technology Connections video : https://www.youtube.com/watch?v=va1rzP2xIx4
Re: I bricked my Christmas lights
#49FTA: > When we try and decrypt the on and off packets we get: > 05 54 55 52 4E 01 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 00 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 01 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 00 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 01 00 00 00 00 00 00 00 00 00 00 > 05 54 55 52 4E 00 00 00 00 00 00 00 00 00 00 00 > Success! This is a lot more sensible. A fixed header, by…
The header is fixed in this case.. By length and start point.
Re: I bricked my Christmas lights
#50Why are these messages encrypted? Is that just a standard thing?