Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking My Landlord's Boiler

blog.videah.net

Post reply on HN
Print view View original

21–30 of 232 posts

Re: Attacking My Landlord's Boiler

#21

Post by odiroot »

glitchcrab wrote: post #14
yurishimo wrote: post #10

If OP ever shows up here, you probably could have just replaced the thermostat with one that is compatible with your boiler for less money and headache. The boiler market is fairly open to competition as evidenced by the fact that you could find a Honeywell signal in a random OSS project that also worked. Good luck with your future apartment customizations!

I think you missed where it was explained that the apartment is rented and therefore you cannot modify anything.

Replacing a thermostat is very easy to do though. And very easy to revert too.

Usually it's just acting as a simple relay (on-off switch) so there's two physical wires.

I've got my Hive thermostat running great with various Bosch and Vaillant boilers. And it works great with HA.

Some newer boilers have 12V "smart" controls but still expose 230V "dumb" call for heating pins.

Re: Attacking My Landlord's Boiler

#22

Post by dtech »

avidiax wrote: post #5
willvarfar wrote: post #2

I guess your toolbox really shapes your solution space thinking; as I read through this, being completely lost in the whole world of RF whatnot, my mind jumped straight to an alternative attack that better fit my own tooling: could you encase the thermostat in a box that you can mechanically control the temperature of?

This sounds good, except that cooling a box is problematic. He needs the temperature sensor to read low so that it turns on the heat. That said, if he has access to the interior of the thermostat, I'm sure it won't be difficult to replace the temperature sensor with a circuit to cause it to read either really high or really low on demand.

For such a minor use case a peltier element is suitable. Very energy inefficiënt but you don't need much and it can both heat and cool.

Re: Attacking My Landlord's Boiler

#23

Post by mschuster91 »

kbuck wrote: post #3
willvarfar wrote: post #2

I guess your toolbox really shapes your solution space thinking; as I read through this, being completely lost in the whole world of RF whatnot, my mind jumped straight to an alternative attack that better fit my own tooling: could you encase the thermostat in a box that you can mechanically control the temperature of?

Or attach an ESP32 to the boiler's control board that closes a dry contact circuit...?

The problem is, if your landlord ever comes around for inspection, or the bloody thing breaks down due to your installation attempt, you can be held liable up to and including getting evicted.

Re: Attacking My Landlord's Boiler

#24

Post by mschuster91 »

odiroot wrote: post #21
glitchcrab wrote: post #14

Earlier quoted context omitted.

I think you missed where it was explained that the apartment is rented and therefore you cannot modify anything.

Replacing a thermostat is very easy to do though. And very easy to revert too. Usually it's just acting as a simple relay (on-off switch) so there's two physical wires. I've got my Hive thermostat running great with various Bosch and Vaillant boilers. And it works great with HA. Some newer boilers have 12V "smart" controls but still expose 230V "dumb" call for heating pins.

> Usually it's just acting as a simple relay (on-off switch) so there's two physical wires.

Vaillant has a proportional signal as well, and that thing in my old home was 30 years old... [1]

[1] https://www.mikrocontroller.net/topic/126250?page=single

Re: Attacking My Landlord's Boiler

#26

Post by kleiba »

YakBizzarro wrote: post #12

Funny how the manufacturer proudly claims that the protocol is encrypted, but completely forget to mitigate replay attacks,thus making the encryption completely useless

Which raises the question whether the OP now unknowingly also controls the heater in the apartment next to his...

Re: Attacking My Landlord's Boiler

#27

Post by Freak_NL »

smelendez wrote: post #11

I wonder what the ideal one-size fits all thermostat looks like. The one in my apartment has a “feature” a lot of US thermostats now have, where you set four ordered times called wake, leave, return, and sleep and the temperature you want the space in each interval. I know very few people who actually live in a household where everyone wakes, leaves, returns, and sleeps on the same schedule every day. I work from hom…

Isn't this pretty much what these thermostats already allow? I have a new Honeywell Thermostat which basically does what the twenty years old one it replaced does with a few added conveniences in terms of UI. It has those wake/leave/return/sleep instants for each weekday (but also adds an optional second leave/return pair), and it has an option to override the day programme to 'holiday', which is essentially an eighth programmable weekday you can activate at any time.

Your use case is possible with that. Just set the standard program to 15°C, and activate the holiday set to whatever you need whenever you want. Configure it to go to 15°C at some sensible time in the evening, so it won't go on even if you forget it.

Re: Attacking My Landlord's Boiler

#28

Post by anal_reactor »

willvarfar wrote: post #2

I guess your toolbox really shapes your solution space thinking; as I read through this, being completely lost in the whole world of RF whatnot, my mind jumped straight to an alternative attack that better fit my own tooling: could you encase the thermostat in a box that you can mechanically control the temperature of?

I've heard a story of people renting an apartment with locked thermostat to the legally allowed minimum. Tenants would put ice on the thermostat

Re: Attacking My Landlord's Boiler

#30

Post by LeonM »

solarist wrote: post #25

One doesn’t actually need any extra hardware for this… just 8cm of wire and this https://github.com/F5OEO/rpitx (use at your own risk of course)

From the linked repo:

> rpitx is a general radio frequency transmitter for Raspberry Pi which doesn't require any other hardware unless filter to avoid intererence. It can handle frequencies from 5 KHz up to 1500 MHz.

Wait, how does that work?

1.5GHz is a _lot_, I can't imagine this is done with bit-banging an I/O line, nor do I expect the Pi will have a DAC with anything close to a 3GHz+ sample rate.

> Plug a wire on GPIO 4, means Pin 7 of the GPIO header (header P1). This acts as the antenna.

A bit of Googling shows me that on the later Pi board GPIO4 (pin 7) has a bunch of alternative modes, amongst which is a general purpose clock output (GPCLK0), a DPI output bit (DPI_D0) and what I recon is composite analog video in/out (AVEOUT_VID0, AVEIN_VID0), and the TDI JTAG pin. But none of these would get close to 1.5Ghz TRX capabilities, no?

What's the magic here?

Post reply on HN